Dirt Cheap Hacking Tools Blog

Dispatches from the Dirt Cheap Dungeon – store: https://www.dirtcheaphackingtools.com – Fedi: https://infosec.exchange/@hackingtools

The Dirt Cheap LiDAR Detector is an small device which uses PIN silicon infrared diodes, a Schmitt Trigger, and some math to detect the TrueDepth Dot Grid Lattice LiDAR projected from the backs of iPhone Pros, and possibly other LiDAR sources too!

I originally made this because Samy Kamkar inspired me with his laser mic talk and then fellow hackers at DEF CON discouraged. I did it anyway after pointing my phone at a flipper zero a few months later and remembering all of that.

I wrote a couple of blog posts for my day job employer about the hardware and firmware design process, you can read those here and here.

Features

  • Can operate standalone (USB-C)
  • Plugs into the Flipper Zero (requires 5V rail and installing the app)
  • 6 discrete IR PIN silicon photodiodes
  • iPhone Pro TrueDepth LiDAR detection
  • Optional RGB detection indication
  • Optional super bright white LED pair for lens dazzling upon detection

When can I get one?!

Project State

  • Concept
  • Design phase
  • Testing
  • Blog Posts for Work
  • Feature Creep, add flipper headers, dazzle LEDs, fancy up design and UI
  • Redesign for Dual USB/Flipper format
  • Prototyping
  • Testing
  • Small Batch Order and Sales Round One
  • Find contract manufacturer
  • Mass produce
  • Sell

The Dirt Cheap Probe Arm is a handsfree probe arm which combines the convenience and ease of use of a magnetic base and flexible arm with the stability and resistance to falling of a rigid frame. The arm features M4 screw terminator to which probe heads can be mounted. The following heads are directly supported:

Overview

Coming soon...

When can I get one?!

Project State

  • Concept
  • Materials Selection
  • Design phase
  • Testing
  • Find contract manufacturer
  • Mass produce
  • Sell

These Probes Fit Everything!

The Dirt Cheap Probe is a low-cost high-quality probe head for third-hands like SensePeeks SP/SQ series and more common 4mm screw and air nozzle style third hands. These heads feature premium Schmartboard jumpers and P50B sharp pogo pins, and are easily end-user serviceable.

We released V1 back before DEF CON 32, and have received feedback and noticed some areas where we could improve in our own testing, and have been working on a new design for V2 we are releasing in Q1 2026!

V2

Redesigned for a shorter reach and a lower center of gravity while still maintaining compatibility with as many third-hand arms as we could find! Available now!

Technical Details

Drawing

Known Fits

  • SensePeek SP10
  • SensePeek SQ10
  • M4 Bolt Generic
  • Loc Line Nozzle ¼”
  • Most Generic Third Hands Available On Amazon and Ali Express

Testimonials

The center of gravity is kind of high, but otherwise really nice

— Coworker given a set for free

It being more narrow really pays off for these tiny 1.27mm jtag pads

— Nullstring during testing V1s

Yo dog you got the fresh tools

— Satisfied Customer

When can I get one?!

Project State

  • Concept
  • Initial PoC
  • Finalize design
  • Mass Produce
  • Sell (V1)
  • Redesign (V2)
  • Mass Produce (V2)
  • Sell (V2)

V1

Now Retired

The ESP32anza is a clip-on debugging harness for common ESP32 SoMs. The design leverages FlexyPins to achieve an easy to apply and remove clip which can be applied directly to the castellated edges of the ESP32 SoM. Access to the pins is exposed via second board connected via FPC which provides plain 2.54mm pin headers for all target device pins.

Overview

Coming soon...

When can I get one?!

Project State

  • Concept
  • Initial PoC
  • Finalize design
  • Find contract manufacturer
  • Mass Produce
  • Sell

The Dirt Cheap Dialer is a retro pocket tone dialer designed around a SAMD21, LiPo battery, amplifier, and a speaker. The device features a full 12-button keypad, visual display, touchpads, rocker switches, and lots and lots of LEDs. Small enough to be kept in the pocket, but beautiful enough to want to wear on a lanyard.

Overview

Coming Soon...

Features

  • Redbox tones
  • Bluebox tones
  • Graybox/DTMF tones
  • Custom tones
  • Customizable keypad assignments
  • Unique, beautiful hardware and UI design
  • Lots of LEDs!

When can I get one?!

Project State

  • Concept
  • COTS PoC
  • Early design stages
  • Final design, order, and testing
  • Mass produce
  • Sell

The BananaPhone is a USB-C to RJ-11 FXS-SLIC which turns any landline into what your cellphone will see as a nice headset with external controls!

Don't you miss twirling the cord around your finger while you gossip with the girls? Don't you miss slamming the handset down on the base so hard the punk on the other end of the line would get an ear ache? Don't you miss the old Conair phones?!

WAKE UP, BB, The Past is Calling!

Overview

Coming Soon...

When can I get one?!

Project State

  • Concept
  • COTS Prototype
  • SAMD21 design
  • SAMD51 design
  • Final Board Design
  • Firmware Work
  • Testing
  • Mass Produce and Sell

The Dirt Cheap Filament Jam Sensor is an ADNS9800-based device which installs like a filament filter and monitors the motion of filament through itself during printing. The device can be configured to provide information like consumed filament and detected jams over Wi-Fi to a remote host, such as a Home Assistant instance, as well as be physically connected to a 3D printers filament runout sensor circuit.

The design motivation behind this device was a discovered difficulty in directly observing extruders to detect jams or grinds as opposed to a break or runout. Most extruders do not expose a view of the gears in a manner which can be easily observed in an affordable way. Rather than trying to figure out how to train some model and use some camera to detect this, I decided using something simple like a computer mouse would work way better.

This idea has been successfully tested with some COTS boards. ADNS9800 breakouts are pretty easy to acquire, and other than that you really only need a microcontroller. ESP32s make this very easy, so if you want to skip waiting and buying this from me, making your own should not be too bad!

Overview

Coming soon...

Project State

  • Concept
  • COTS PoC
  • Early board design
  • Prototyping
  • Final design and order

Overview

Nullstring's Prison Clear Payphone Back Pack is the best of ideas come up with in response to the question “what is the dopest thing you could make Prison Clear?”

Do you remember the Conair landline phones from the 80s and 90s? The clear ones, with all the colors inside? Envision that, but its a payphone! Now, double down on that because its a fully wireless, battery-powered, properly functioning payphone on a back pack frame!

I Want One!

You can't have one! BUT! You CAN have a BananaPhone! A BananaPhone is the core and heart of the Payphone Back Pack! It is a USB-C adapter to connect landline phones to your cellphone!

COTS Iterations – Gross, Bluetooth!

todo: describe the cell2jack and xb2, describe the COTS demo taken to DEF CON, describe how these COTS devices are marketed to olds who still want to use a landline phone, all of them lack wired connections, and its not cool to solve it this way – so, we design our own usb audio class device instead. add a photo or two of the COTS demo.

  • Cell2Jack or XB2
  • Cellphone
  • Landline Phone
  • LIPO Pack

Not good enough!

Original Payphone Parts Used

  • Western Keypad/Hook assembly
  • MEI Coin Mechanism
  • Hotwired Elcotel Mainboard

Housing Design

todo: describe the process of measuring the real housing and creating CAD models, making changes to accommodate modularity and cheaper fixes if there are issues down the line and also to accommodate SLA printing process.

Can we cast it?! No!

todo: describe the issues with trying to make a casting mold from something like a weather proof painted payphone housing thats all rusty and old and also very large and covered in bits and bobs.

3D Modeling

todo: discuss the process of measuring and modeling the payphone housing

first in tinkercad “how hard could it be”

todo: add some screenshots and discuss how shitty tinkercad becomes the more complex a model becomes, and how it fails to export high enough quality meshes to be able to be large scale sla printed successfully

then in fusion “how much harder can it get”

todo: add some screenshots and discuss some of the differences between my housing and the normal housing, some of the changes made to support sla printing, and some of the changes made to support modular assembly so if something doesnt mount right the entire model does not need to be re-printed at incredible cost

Printing

FDM Test Printing

todo: add photos here

Large-Scale SLA Printing

Yet to do this because tariffs make it insanely expensive and I would like to only do it once.

BOM Generalized

Controller Board

  • Custom SAMD51 board
  • Fully isolated high-speed USB 2.0 Audio Device Class – “USB Headset”
  • ProSLIC-based FXS with Quasi-Cuk HV circuit and built-in DAC
  • SD storage
  • 32x32 RGB LED Display (front interior of coin box)
  • 5” 3-Color E-Paper Display (center front branding card)
  • 1.5” Transparent OLED Display (front top left volume button / sticker)
  • 1” OLED Display (number card)
  • GPIO for operating relays for EL-Wire and Discrete LEDs
  • GPIO for operating Coin Mechanism
  • Many WS2812 RGB LEDs
  • LiDAR Detection (to know when its photo is being taken)
  • LoRA Meshtastic Sidecar board

Power Board

  • Fused input from 12v 50aH LiFePO4 battery with onboard BMS
  • 4x Fused Output Rails: 3.3v@4a, 5v@4a, 5v@5a, 12v@20a
  • MOSFET-based Remote GPIO+Physical Switch Controls Per Rail and Main Cutoff
  • INA219 for Voltage Monitoring
  • Multiple discrete EL-Wire inverter boards
  • Rail-direct, GPIO controlled relays for LEDs and other components

Features

  • Wireless, battery powered, back pack mounted functioning payphone – But Clear and Colorful!
  • Any amount of change lets you place a call!
  • Incoming and outgoing calls completed via cellular network
  • Full Redbox support
  • Bluebox minigames facilitated by an onboard simulated POTS network
  • It blushes when you take its photo with an iPhone Pro
  • It has FOUR displays! and EL-WIRE! and LEDs!
  • It might read received text messages aloud!

When Can I See It?!

Project State

  • Concept
  • Buy a payphone, strip and gut it
  • try to use housing to make casting mold – this fails
  • begin using housing for measurements for CAD model
  • work in tinkercad – it becomes a nightmare
  • work in fusion, far far far better, learn a lot that ends up propelling other projects
  • acquire or make Western/GE style handset – BUT CLEAR
  • start FDM prototyping the housing model
  • waste a bunch of money on wrap and paint and heatshrink for when its time to make it colorful
  • try prototyping with samd21 and KS0835 SLICs – find this to be saddled with too many problems and no way to solve them
  • design samd51-based board which can handle everything including the DAC stuff internally and well
  • Breadboard Final COTS assembly and tests
  • Boards Final Design, Order, and Testing
  • Housing Model Final Adjustments and Order
  • Final Assembly and Testing
  • Take it on Tour

Upcoming Appearances

  • TBD

A fancy camera with an e-paper display and an accelerometer so you can shake it to display captured photos!

Overview

The E-Paper Polaroid Badge is was a planned Unofficial DEF CON badge featuring:

  • 4.2” E-Paper Display
  • OV2640 Camera
  • Accelerometer (Shake To Reveal, like a polaroid!)
  • SD Storage
  • Bluetooth
  • Li-Po Battery Powered with optional Full USB Bypass (for when the conference is over and you want to power it 24/7)
  • Many RGB LEDs
  • LED-based Flash
  • Ambient Light Detection

A COTS cobbled version of this design was worn at #DEFCON32.

State

Killed in the crib.

Note: I stopped working on this project after I saw that I had missed that Adafruit has an OV2640 camera that is almost the exact design I was making except with an OLED or something instead of an e-paper.

Get one of these for way cheaper instead.

Coming Soon...

Overview

The Dirt Cheap EMP is an XYZ Stage-mountable Electromagnetic Fault Injection tool based on the High Voltage section of the ChipShouter-PicoEMP and FaultyCat.

Unlike other low-cost EMFI tools, the Dirt Cheap EMP features no controller and must be operated by an external fast-gpio capable device, such as a Raspberry Pi RP 2040/2350. An optional RP2040-based controller is also in development.

The EMP device is designed to be XYZ-stage mounted using the same format as a 40mm fan, with 4 4.1mm mounting holes spaced in a square at 32mm from one another. This format allows the device to be mounted on most 3D printer toolheads, as well as on similar easily DIY-made solutions. While traditional commercial and industrial XYZ-stage solutions can cost from hundreds to many thousands of dollars, an adequately comparable level of precision for the purposes of EMFI attacks against consumer-grade hardware can be achieved for a significantly lower cost.

This lowers the barrier to entry for performing more well-automated attacks against chip packages by more hackers. Tactical diffusion, democratization of access.

Development

Prototype 1 Schematic

Prototype 1 Board Layout

Prototype 2 Models

Controller

~250V EMP

Testing

Coming Soon...