Pokemon Go inherits a certain vulnerability to GPS location spoofing from it’s predecessor Ingress, but also the progress that has been made in spoof detection. Since taking advantage of a game’s underlying mechanisms is part of the winner’s game, why not hook up your smartphone to Xcode and see if you can beat Niantic this time? [Dave Conroy] shows you how to play back waypoints and activate your Pokemon Go warp drive.
The hack (therefore the Monospace) is based on the developers toolkits on Android and iOS, and also the easiest way to get banned from the game. On an Android smartphone, you need to get one of the many GPS spoofing apps from the Play store, repeatedly tap About phone to activate the developer settings and select that app as GPS spoofing source there. As [Max] points out in the comments, you may also need to install the mock mock locations Xposed module, which requires a rooted device. In iOS, you can (probably) also install a spoofing app through Cydia, although the easiest way without jailbreak is creating a new iOS app in Xcode (or any iOS application you have at hand) and build it to the phone. While in debugging mode, you can then load a *.GPX-file, which is simply a text file containing GPS waypoints in the XML-based GPS Exchange Format:
The file is loaded via Product -> Debug -> Simulate Location -> Add GPX file to project, as shown in the video. This makes the waypoints or tracks available from the Simulate Location menu. From there, you then can then teleport your phone to the defined locations, or take it for a walk along the tracking points.
While the video is more a tutorial on how to get banned from the game than anything else, we’re not here to judge you if you try it. In the contrary, we’d actually love to see an implementation that catches ’em all without falling over the various strings Niantic has put in place, effectively turning GPS spoofing into a game of its own. Check out the video below to see [Dave Conroy’s] approach.
Oh, and did we mention this is probably get you banned? Can’t stress this one enough.
This famous photo of a crashed train engine leaning against a building is often seen on posters warning people to plan carefully. The photo was taken on 22 October 1895 at the Gare Montparnasse in Paris. It is commonly referred to as the Montparnasse derailment.
At 4:00pm that day the Granville–Paris Express ran through the bumper at the end of the track. (Here are photos of track bumpers, also known as buffer stops.) The train was running late, so the driver was going faster than usual. Unfortunately, the Westinghouse air brake failed. After breaking through the bumper, the train skidded across the concourse and broke through the two-foot thick station wall. The engine fell 30 feet to the street, ending up as you see in the photo. None of the 131 passengers died, but six people were injured and one woman in the street died when she was hit by falling debris. The woman was working at a newsstand at the time. The railway company supported the woman's two children.
The passenger cars were completely undamaged. Ten men used a winch to lower the locomotive, which was taken to a repair station. An inspection revealed only minor damage.
The crash was beautifully recreated in Martin Scorsese's Hugo. Here's the clip, along with some behind the scenes footage of the making of the models and special effects:
Electricity comes in two basic forms: Alternating Current (AC) and Direct Current (DC). DC is handy to use and is easy to analyze. However, AC has some useful properties too. In particular, AC current can operate a transformer which can step it up or down easily. Power is conserved, of course (well, actually, you get less power because of losses in the transformer).
You can’t do that trick with pure DC. You can reduce a voltage, although that typically wastes power in heat (for example, a voltage divider or linear regulator). You can’t readily increase a DC voltage unless you convert it into some sort of AC first.
This was a particularly bad problem in the era of tubes–especially tubes in car radios. The car’s voltage was probably 12V but the tube’s plates might take hundreds of volts. What do you do? Some old car radios used what is called a dynamotor. This is just a motor and a generator in one box. You could spin the motor with 12V and have the generator produce a different voltage (even a DC voltage).
The Electric Dynamotor
If you think about it, a transformer is really just a generator (the secondary) with the shaft replaced by a moving magnetic field (the primary). However, with a dynamotor, you can use a DC motor to spin the input. With a transformer, you must have AC input because that’s what moves the magnetic field. Note you don’t have to have a sine wave, necessarily, just current that switches polarity fast enough to drive the primary.
So how do you get the DC in a car radio into AC? There’s a clue in another part of the car: the blinkers used to flash the lights. Today, you’d probably do the blinking with some electronics, but old cars didn’t have a lot of electronics. What they did have was a special kind of device. When you apply current to the device, it would heat up a bimetallic strip. The strip would slowly move and break the current flow. This would cool the strip down which would resume its original position and start the current flowing again.
If you wanted things to go faster, you could do the same trick with a relay. Have the relay coil take current through a normally closed contact. When you energize the coil, the contact opens and breaks the current flow. The contacts then close and the process repeats.
Testing, 1, 2, 3
Old tube testers in the drug store (see right) often had a test for vibrators. In those days, that didn’t have the meaning you’d expect today. In fact, a vibrator was a relay wired to interrupt DC current into AC. You might expect that these failed pretty often and a trip to the drug store would let you test vibrators and tubes, buy a replacement, and repair your own devices.
The name vibrator came from the characteristic buzzing noise made by these devices. Once the DC was broken up by the vibrator, a transformer could step the voltage up (or down, but it was almost always up). This produces a higher AC voltage that the circuit would then rectify and filter to get the desired higher voltage.
There was actually a lot more to making a good vibrator power supply than you might think. The mechanical parts moved constantly. Also, the contacts would spark and that would eat at the contacts. It also created a lot of interference or hash. A good design would suppress sparks and hash. The resulting rectified current needed a good bit of filtering, too. The photo to the left shows a pair of Heathkit vibrators, including the internal structure that was normally hidden.
Although the vibrator seems inefficient, it beat the dynamotor. It was quieter, had fewer moving parts, was smaller, and cheaper. At the time, it seemed like progress.
Vibrators are long gone except in vintage gear. Transistor power inverters became practical and edged them out. Today, you would be more likely to use a switching mode power supply to get the same effect. The principles aren’t that different, but the conversion of DC to AC is electronic and the control is more precise.
If you want to see more about vibrators–including schematics–check out the video below.
To decode the device’s packets he reached for his RTL-SDR receiver and took a look at it in software. GQRX confirmed the presence of the carrier and allowed him to record a raw I/Q file, which he could then supply to Inspectrum to analyse the packet structure. He found it to be a simple on-off keying scheme, with bits expressed through differing pulse widths. He was then able to create a Gnu Radio project to read and decode them in real time.
Emulating the transmitter was then a fairly straightforward process of generating a 350MHz clock using the on-board PLL and gating it with his generated data stream to provide modulation. The result was able to control his fan with a short wire antenna, indeed he was worried that it might also be doing so for other similar fans in his apartment complex. You can take a look at his source code on GitHub if you would like to try something similar.
It’s worth pointing out that a transmitter like this will radiate a significant amount of harmonics at multiples of its base frequency, and thus without a filter on its output is likely to cause interference. It will also be breaking all the rules set out by whoever the spectrum regulator is where you live, despite its low power. However it’s an interesting project to read, with its reverse engineering and slightly novel use of an FPGA.