SIOT Logs
Enable the internal pull-up on IO4. Released, the resistor pulls the pin up to 3.3 V and it reads 1. Pressed, the button connects the pin to GND and it reads 0. The button is active low.
* The pull-up gives the pin a level when the switch is open; the switch only ever pulls it d...
Q What is Wireshark, and what does it show about the traffic it captures?
A free, open-source packet analyser. It captures every packet entering or leaving a network interface (through the pcap library) and decodes each one layer by layer: addresses, ports, protocol fields and, for unencrypted traffic, the payload itself.
Wireshark runs on Linux, macOS...
Q An attacker has physical access to an ESP32-based device. What can they do through its USB serial po...
Read the whole flash (firmware, Wi-Fi credentials, server addresses, keys) and write their own firmware. Flash encryption makes the dump unreadable, and secure boot makes the chip refuse unsigned firmware.
The same tool that flashes a board also reads it. esptool read-flash 0 0x4...
Q What happens if a button input has no pull-up or pull-down resistor at all?
While the button is open, the pin is floating: connected to nothing, so it picks up noise and reads random 0s and 1s. The LED flickers, or turns on when you only touch the wire.
A digital input draws almost no current. That is what makes it good at sensing a voltage, and also wha...
Q How do tcpdump and Wireshark divide the work in sudo tcpdump -w capture.pcap -i wlp4s0, followed by...
tcpdump is the lightweight command-line capturer: it records raw packets from the interface (-i wlp4s0, the Wi-Fi card) into a pcap file (-w capture.pcap). Wireshark is the graphical analyser that opens that file to filter and decode it. Both need root because capturing reads raw...
Q The "open" button is wired between GPIO0 and GND. Why does holding it while the board resets stop th...
GPIO0 is a strapping pin. If it is low at reset, the ESP32 enters its serial bootloader (download mode) instead of running the app. A button from GPIO0 to GND held during reset does exactly that, which is also how the board's own BOOT button works.
At reset the ESP32 samples a fe...
Q Why can one press of a push button register as several presses, and how is that fixed?
The metal contacts bounce: for a few milliseconds the switch opens and closes rapidly before it settles, so the pin sees several edges. Debouncing accepts a new state only after it has been stable for a while, typically 10-50 ms.
* The chip is fast enough to see every bounce as...
Q A laptop on the same Wi-Fi as an IoT device runs Wireshark. Which of the device's packets can it act...
In normal (managed) mode, only traffic to or from the laptop itself, plus broadcast and multicast. To see frames between other stations it has to switch the card into monitor mode. On an open network those frames are then readable; with WPA2/3 they are encrypted.
A Wi-Fi card in...
Q How can a FreeRTOS program notice a button press: by polling or with an interrupt? What are the trad...
Polling: a task reads the pin every few milliseconds and sleeps in between. Interrupt: the pin's edge triggers an ISR that wakes a waiting task. Polling is simpler and filters bounce. An interrupt reacts at once and uses no CPU while idle.
* Both end in a task setting the LED; t...
Q An ESP32 with two buttons opens and closes a garage door by sending requests to a server over an ope...
The traffic is unencrypted and unauthenticated. By sniffing one real "open" request, the attacker learns the server's address, port and the exact request, and can send the same request again: a replay attack.
* The server cannot tell the replayed request from the real one. *
The...