Debugging / reversing Firebase gRPC traffic with mitmproxy

Recently, I was stuck in figuring how the Firebase gRPC calls worked and how I could generate, modify, and replay them. Trapping and modifying the existing gRPC traffic was not working too well. Finally, I took a step back and spent some time on learning how to build and debug simple Firebase applications. This approach helped me tremendously and I was able to make further progress with my original task in almost no time. ...

April 16, 2025 · 3 min · 433 words · Dhiru Kholia

Reimagining the 'Tangara' music player - Part 2

Tangara is a pretty awesome project! It recently inspired us to build a similar FOSS DAP product but at a much lower cost of <= 40 USD. Our initial tech stack: RP2350-Zero, PCM5102A 32-bit 384kHz DAC, Burr-Brown OPA1662 (specified for 3.3v) as the unity gain buffer and headphone driver, no explicit DC-DC converters anywhere, microSD card, everything will be a module if possible We quickly got this prototype working on a breadboard and discovered some limitations: ...

April 11, 2025 · 5 min · 957 words · Dhiru Kholia

Reimagining the 'Tangara' music player

Tangara is a pretty awesome project - no doubts about it. I found this review of Tangara's design pretty interesting and educational. It has inspired us to build a similar FOSS DAP product but at a much lower cost of 40 USD (that being the launch price of Sansa Clip in year 2007). The idea is to deliver '90% of the value' of Tangara in a slightly smaller (but fatter) and more cost-effective package. ...

February 15, 2025 · 3 min · 574 words · Dhiru Kholia

Easy Taint Tracking - Finding Heartbleed in 2024

Aim Finding 'Heartbleed' class of bugs with taint analysis. Background reading: https://heartbleed.com/ Motivation While Coverity is now able to detect this bug, we wanted to evaluate the state of open-source security tooling in 2024. Have we been able to reduce the cost of finding such bugs after all these years? The Idea Can we find an execution path from the tainted data in the n2s function to sensitive functions? Since n2s typically operates on network received bytes, it can serve as a taint source. ...

November 1, 2024 · 3 min · 488 words · Dhiru Kholia

My solar powered website

This notebook (aka 'blog') is powered by free solar energy! I was (and am) inspired to start writing again by reading this excellent article by 'LOW←TECH MAGAZINE'. Imitation is the sincerest form of flattery… Tech stack: Navitas 100W Solar Panel, Exide solar charge controller (10A), Exide Solar Blitz 40AH battery, 200W 20A DC-DC CC CV Buck module (Robu), Cuzor Mini Pro RouterUPS (12V), LM2596S DC-DC 24V/12V to 5V 5A Step Down USB module, Raspberry Pi Zero 2W ...

January 1, 1999 · 1 min · 181 words · Dhiru Kholia