Jude Karaki Notebook - cps-vip/cps-cosimulation-env GitHub Wiki
Week of 4-23
Presented final presentation and spoke with team about possible paths forward next semester.
Main takeaways: Need more SD cards. Figure out step by step plan to achieve basic disk encryption on the headless pi. Need to figure out workaround for VNC server error, never ended up working on my computer. Do more research on LUKS and develop a better understanding of the actual disk encryption processes and algorithms.
Week of 4-16
Primarily worked on slides for final presentation and communicated with group about what needs to be done before the end of the semester. Attempted to bypass VNC error again but could not get it to work for my PC. Still waiting for my own SD card to attempt to try with my own pi outside of class.
Week of 4-9
Was not able to attend in person today, did general research and reviewed gala's notebook for more information while staying in discord in case anything needed to be discussed.
Did more research on the errors we had been struggling with:
Usually caused by VNC server not running on the Pi, no IP address, or firewall blocking the connection
The "already another console session" error happens when something else is using the display session, like a local login or a hanging remote session
The firewall and routing commands we tried were meant to allow ping traffic, enable IP forwarding, and set Wi-Fi to Private so Windows would be less restrictive
After more reading it seems like most of these issues trace back to the Pi not having a proper IP address, which would explain why the Windows-side fixes didn't help
Sources:
https://help.realvnc.com/hc/en-us/articles/360002249917-VNC-Server-on-Raspberry-Pi-Troubleshooting https://www.raspberrypi.com/documentation/computers/remote-access.html
Week of 4-2
Tried to help figure out VNC error we have been struggling with that is not letting us connect our raspberry pi to the VNC server.
Also attempted Remote Desktop Connection but had no luck as it was saying there was already another console session so we could not start one. Attempted on both of our computers but no difference.
Also tried these commands as recommended: netsh advfirewall firewall add rule name="ICMP Allow" protocol=icmpv4:8,any dir=in action=allow
Restart-Service SharedAccess
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" -Name "IPEnableRouter" -Value 1
Set-NetConnectionProfile -InterfaceAlias "Wi-Fi" -NetworkCategory Private
Week of 3-26: Spring Break
Week of 3-19
Was not able to get my own physical Pi, so I will just follow along with the group's documentation until I can get one.
Familiarized myself with the network setup and remote desktop setup instructions that were given to us. Also did more research on the possible ways we could go about unlocking the headless Pi and set new goals with Hayden to have the physical pi encrypted and be able to remotely unlock it by the end of the semester.
Some possible ways we could go about this that I found after some basic research:
SSH unlock using Dropbear embedded in the initramfs
Setting up a lightweight web server in initramfs to unlock via browser
Using a USB keyboard briefly just for unlock then removing it
Network-Based Disk Encryption (NBDE) using a key server like Tang/Clevis to auto-unlock when on a trusted network
Storing the key on a removable USB drive that gets plugged in at boot
I am not sure which of these is most viable. I will discuss each of these options with Hayden once we can properly get the Pi set up and I have a bit better understanding of what the process would look like for each.
Week of 3-12
Still waiting to get my own physical headless rasp pi and decided to do more research on takeaways from last week:
Pi boots differently from a regular computer, it uses its own GPU firmware to read the boot partition before the kernel even loads. Because of this, the boot partition has to stay unencrypted and formatted as FAT32 so the firmware can read it.
Only the root partition can be encrypted so on the SD card you end up with two partitions: one small unencrypted boot partition and one LUKS-encrypted root partition
On the Pi specifically, you need to edit config.txt to tell the firmware to actually load the initramfs, and edit cmdline.txt to point the kernel to the encrypted root device. The big problem for headless setups is that there's no keyboard to type the LUKS passphrase at boot.
Our Pi 5 wont have a TPM so I do not know how to have it auto-unlock itself, SSH unlock seems like the best option for now.
Sources: https://pidiylab.com/full-disk-encryption-raspberry-pi-headless-unlock/ https://github.com/ViRb3/pi-encrypted-boot-ssh https://www.raspberrypi.com/documentation/computers/configuration.html https://wiki.archlinux.org/title/Dm-crypt/Specialties#Remote_unlocking_of_root_(or_other)_partition
Week of 3-5
Got it working after reinstallation and followed through steps Gala went through to set up disk encryption experimentation on the raspberry pi os within the VM.
Added new virtual disk in VirtualBox Settings → Storage, confirmed with lsblk showing new device as sdb
Ran sudo apt update and sudo apt install cryptsetup to get encryption tooling ready
Initialized LUKS on the new disk with sudo cryptsetup luksFormat /dev/sdb — needed sudo for kernel-level disk access
Opened the encrypted volume with sudo cryptsetup open /dev/sdb encrypted_disk to create a mapping under /dev/mapper/
Created ext4 filesystem on the unlocked volume with sudo mkfs.ext4 /dev/mapper/encrypted_disk
Created mount point with sudo mkdir /mnt/encrypted
Mounted decrypted volume with sudo mount /dev/mapper/encrypted_disk /mnt/encrypted — anything written to /mnt/encrypted/ is now automatically encrypted on disk
Verified encryption was working by checking LUKS headers with sudo cryptsetup luksDump /dev/sdb
Key takeaway: the encryption/decryption is transparent to the user once the volume is unlocked — files look normal inside /mnt/encrypted/ but are ciphertext on the actual disk In the meantime did more research on how this process would translate from VM to physical Pi — boot chain differences, partition layout constraints, and the need for initramfs-based unlock on a headless device
Week of 2-26
Still attempting to follow rasp pi OS tutorial and cannot get it to accept set credentials on ssh.
Tried to restart and ended up reinstalling over the weekend.
In the meantime did more research on how the disk encryption process would translate from the VM OS to the physical device. Found that same cryptsetup/LUKS commands work but kernel modules and boot process differ.
The physical Pi uses its own bootloader and the firmare loads from the SD cards partition before the kernel which means we have to leave /boot unencrypted.
Week of 2-19
Followed Rasp Pi OS tutorial as well https://roboticsbackend.com/install-raspbian-desktop-on-a-virtual-machine-virtualbox/#Virtual_Machine_Name_and_type
Installation was about 3 hours and was unable to make significant progress afterward. Will ask about how to use it more effectively next class.
We are waiting for physical headless raspberry pi that were ordered to arrive so that after we figure out disk encryption on rasp pi OS we can apply knowledge to physical raspberry pi.
Week of 2-12
Installed VirtualBox; created Ubuntu Desktop 24.04 LTS VM with minimal resources (2 GB RAM, 1 core, 15 GB disk)
Helped troubleshot black screen issue by switching graphics controller to VBoxSVGA, increasing video memory, disabling 3D acceleration, and booting in safe graphics mode.
Did general Vbox research:
VirtualBox = free, open-source hypervisor for running virtual machines on your host OS
Safe environment to experiment with disk encryption before touching a physical Pi
lsblk inside the VM to verify virtual disks are recognized before encrypting
Week of 2-5
Read through paper Galadriel found about LUKS disk encryption: paper on full disk encryption with LUKS
Did research on raspberry pi emulation and how to use headless raspberry.
Headless = no monitor, keyboard, or mouse — all interaction over the network Pre-configure before first boot via Raspberry Pi Imager: set hostname, enable SSH, add Wi-Fi credentials, set username/password.
Key tools: raspi-config, cryptsetup, dropbear-initramfs, initramfs-tools
Week of 1-29
Formally joined Disk Encryption subteam, and did basic background research on disk encryption, specifically for raspberry pi.
Studied LUKS architecture: two-level key hierarchy (master key + user keys), anti-forensic splitter, salt + key derivation functions, iteration count tuning.
Compared LUKS1 vs LUKS2 header formats and discussed why LUKS2 is now the default in cryptsetup.
Sources: The original LUKS spec (https://gitlab.com/cryptsetup/cryptsetup/-/wikis/LUKS-standard/on-disk-format.pdf), the cryptsetup FAQ (https://gitlab.com/cryptsetup/cryptsetup/-/wikis/FrequentlyAskedQuestions), dm-crypt page (https://wiki.archlinux.org/title/Dm-crypt)
Week of 1-22
Switched from networking subteam to device security subteam.
Will decide what specific team within device security I will join next week.
Either PUF, Side Channel, or Disk Encryption subteams, leaning towards side channel or disk encryption.
Will do preliminary research on each of the teams and what type of work they would entail.
Deleted remaining files from time in network subteam, if I need to set the VM back up later I will follow Kaden tutorials again.
Week of - 4/24/2025
No class, finals week. Finalized notebook by reformatting all weeks to have the same syntax (same spacing between entries, confirmed all dates, compared wiki entries with rubric on Canvas). I finished my portion of the final paper by restructuring and confirming all content in the executive summary portion.
Executive Summary before:
Executive Summary after:
Week of - 4/17/2025
Began working on my portion of final paper, however, had to wait until later to finish executive summary portion as it is dependant on the other changes made to the paper by other group members.
Presented a networking team slide in class in final presentation on tasks completed by the networking team and future goals for the networking team.
Week of - 4/10/2025
Began working on slides for final presentation, working on networking presentation section as well as conclusion slides for networking portion.
Met with instructor over discord to help fix issue with password permission. Attempted to change share file permissions again, and attempted to verify ip address across files and on my machine, however none of the changes fixed the issue. Will do more reseach as to how I can debug and will get more help from instructor next class in person.
Week of - 4/3/2025
Scheduled meeting with over discord with instructor to fix password permission issue. In class attempted to do debugging research using past stackoverflow entries from people with similar issues, however did not find a fix for my issue.
Redid steps from Kaden's VM installation guide from beginning to potentially fix issue with changes done by editing files with vim. Followed steps all the way through to the point in which I have to enter my machine's password but could not get the permissions to work. Will leave as is until meeting with instructor.
Week of - 3/27/2025
Read ControlHandler interface DNP3 1.6.0 documentation, specifically noted sections on handling select and handling operate.
Read through Kaden's explanation of DNP3 outstation on how to write callback functions using python callback functions. From what I gathered it seems that in a real world scenario the substation will have to be given function pointers to appropriately act on the information given. This is important for my tasks specifically and in the DNP3 example because it gives me a better understanding of why some of the code is structured the way it is. For example: This code - dnp3_outstation_t* add_outstation(dnp3_outstation_server_t *server, dnp3_address_filter_t *filter, dnp3_outstation_config_t *config) { dnp3_outstation_t *outstation = NULL; dnp3_param_error_t err = dnp3_outstation_server_add_outstation( server, *config, get_outstation_application(), get_outstation_information(), get_control_handler(), get_connection_state_listener(), filter, &outstation ); ...
Shows the function pointers that are called when a new value is received (callback functions).
Week of - 3/20/2025
Week of spring break, did slight research on password permission issue, but did not find anything of note.
Week of - 3/13/2025
In class Kaden attemped to help with VM installation issue and find qemu workaround for VM installation. Trying to download different VM to avoid permission issue, left overnight to download.
Met with group on discord to discuss progress with tasks and then met with Kaden after to attempt to fix VM password issue and share file permissions. Also had vim functions and keybinds explained to me in more depth to hopefully be able to do work in vim myself at a later date.
Read Database documentation on DNP3 1.6.0. I now understand the two different database access methods, as well as how to add points to database.
Week of - 3/6/2025
Reviewed individual feedback for midterm notebook check and made changes as necessary. Added more information retrospectively to some entries and made sure to begin keeping better note of work done for the future.
Met with group again and discussed how to move forward with tasks even though I am unable to finish VM installation. Kaden instructed me to skip steps to "next steps section" in VM installation guide. Continued until the end CPS-cosimulation-env steps command nix develop, waiting for download.
Left computer overnight to download nix and did make all-install command, left again overnight to download.
Week of - 2/27/2025
Worked on conclusion slide for midterm presentation. Met with Kaden to attempt to debug password issue. Tried to work around by changing share file permissions to allow read and write from everyone but did not solve issue. Attempted to use vim to change file path to different share location, did not work. Kaden explained some vim functions to me and now I feel that I have a better understanding of how to change files using it.
Presented midterm presentation slides on my task in networking section and portion of conclusion section. Continued working on trying to find workaround for password issue but did not find anything applicable to my situation.
Week of - 2/20/2025
Assigned myself executive summary portion of midterm paper, however, paper link no longer worked for me so had to ask for new link.
Kaden distributed tasks for semester. Task 1 required for everyone, I was assigned task 2. Attempted to get DNP3 example repo running for task 1 but ran into same password issue when trying to run VM. Attempting to find workaround by using seperate VM but need help with installation. Read over C code in vim in an attempt to begin task 2 but share directory was not working so I could not actually make changes.
Completed web based peer evaluations as well as finalizing changes made to midterm paper before sumission.
Week of - 2/13/2025
Continued following along with Kaden's VM installation instructions, but got stuck on step 16, password for machine did not work, was given a permission error. Attempted to debug by running powershell in administrative mode but did not work. Attempted to debug in class with Kaden by changing permissions on share folder, did not work. More research to be done on issue.
Read portion of dnp3 library documentation and watched as other group members ran DNP3 example repo in class. Met with group on discord and discussed upcoming paper, work to be divied up next week.
Also reviewed feedback on notebook so far and made changes as necessary.
Week of - 2/6/2025
Formally joined networking subdivision of Device Modeling team. Networking Team did not meet this week. Followed github cosimulation guide to best of ability with help in class. Currently attempting to install through powershell following steps on github installation guide. Followed discord correspondence and now downloading VM xfce4.
Week of - 1/30/2025
Device Modeling team did not meet this week, however I looked through the resources in the discord and through Vidur's notebook to somewhat acquaint myself with what the team is doing.
Met the group in person for the first time and introduced myself to the Device Modeling and Networking subteams, as of right now I'm not sure what subteam I am actually going to be working with. Networking subteam was working on trying to figure out how to run DNP3 protocals on a VM on architecture other than linux (Mac and Windows OS).
Week of - 1/23/2025
Attended kickoff presentation for ROS Helics and Device Modeling teams. Decided to work with device modeling team as the information presented seemed to be more in accordance with my prior knowledge and future interests. Joined discord and github as well as started notebook.