Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reverse engineering an e-ink display

zeus.ugent.be

Post reply on HN
Print view View original

21–30 of 56 posts

Re: Reverse engineering an e-ink display

#21

Post by redfast00 »

blutack wrote: post #20
redfast00 wrote: post #11

Earlier quoted context omitted.

The idea is indeed to communicate with the tags with their stock firmware (not necessarily using another CC2510, since these aren't made anymore, but that's a possibility). AES is symmetric cryptography, so that should be possible to extract from the firmware. The tags also show a QR code when the aren't initialized yet, this is likely the setup key. I also read that even if tags are already initialized, it's still p…

Some of the marketing mentioned private keys so I stupidly assumed a per transmission negotiation mechanism but of course they probably just mean "symmetric key". A per tag key extraction would be annoying though presumably. The PUK mechanism is very interesting, I'm interested to see what you find in the firmware... For the display, this poster has something similar and talks about a datasheet - there's even a pinou…

Thanks for the interest :) If you have an RSS feed reader, you can add our RSS feed, so you'll automatically get the next blog posts https://zeus.ugent.be/feed.xml

Re: Reverse engineering an e-ink display

#22

Post by soco »

layer8 wrote: post #7

It still somehow breaks my intuition that it’s cost-effective to have thousands of these deployed in each supermarket. I mean, I do understand it rationally, but it’s still weird.

What happens if you see a product with price X and by the time you checkout it has price Y? Can you claim somehow the previous price?

Re: Reverse engineering an e-ink display

#23

Post by irsagent »

Very well written article. I have been looking for some inspiration to get into hardware hacking and I think this article did it for me.

I find it interesting that in most writeups voltage injection is a popular appraoch to turning on debug mode. The aricle makes mention to other class of fault injection attack such as clock glitching or electromagnetic fault injection, but are there other approaches that I could look into, just out of curiousity?

Re: Reverse engineering an e-ink display

#24

Post by adversaryIdiot »

mig39 wrote: post #14
dave78 wrote: post #8

I wonder if there are larger implications to reverse-engineering this. When I worked in retail in high school, I was told repeatedly that if a price was marked on a shelf, then there are laws that require the store to sell that item for that marked price. (IANAL so I don't know the nuances there, but it makes sense). If it becomes easy to change these displays with a new price wirelessly, that could be a really nasty…

I once scored a big bunch of coffee because the local Canadian Superstore confused cents with dollars. The price was listed in cents per kg instead of dollars! At first they refused to honour the price, and fixed their mistake. I sent an e-mail with photos to their corporate office. I received a phone call from someone who was laughing and thought it was all funny. He told me to go back to the store, and as much as I…

That is awesome to hear

Re: Reverse engineering an e-ink display

#26

Post by JKCalhoun »

focusedone wrote: post #3

I'm so happy there are people out in the world able to reverse engineer things like this and share the results publicly. Freakin' cool.

Yeah, waiting for them to finish up so Rob Cockerham can go into a COSCO and have some fun slightly altering the price tags.

Re: Reverse engineering an e-ink display

#27

Post by bsder »

dcow wrote: post #12
dave78 wrote: post #8

I wonder if there are larger implications to reverse-engineering this. When I worked in retail in high school, I was told repeatedly that if a price was marked on a shelf, then there are laws that require the store to sell that item for that marked price. (IANAL so I don't know the nuances there, but it makes sense). If it becomes easy to change these displays with a new price wirelessly, that could be a really nasty…

I’ve only seen a store honor the floor price when it was clearly wrong like once and it was for an item that they were trying to get rid of anyway. I’ve heard the lore too and can’t understand how it could be legally binding for a store to sell an item at the sticker price. Wouldn’t people just walk in with little stickers and mark stuff down as they wished? My wife works in retail and confirms that stores don't just…

> I’ve only seen a store honor the floor price when it was clearly wrong like once and it was for an item that they were trying to get rid of anyway.

I bought six packs of Diet Coke from Target at a discounted price for almost 6 months because they left an old tag up at one particular store. :)

Re: Reverse engineering an e-ink display

#28

Post by [deleted] »

redfast00 wrote: post #11
blutack wrote: post #6

Nice article - is the idea to communicate with the tags with their stock firmware using another CC25x series chip or dev board? Unfortunately, that might be tricky without the private keys in the controller. User manual [0] describes a per site 128 bit AES keys used for the RF comms. Might be easier to just write fresh firmware for them - there's some code here [1] for driving the display that could be ported to the…

The idea is indeed to communicate with the tags with their stock firmware (not necessarily using another CC2510, since these aren't made anymore, but that's a possibility). AES is symmetric cryptography, so that should be possible to extract from the firmware. The tags also show a QR code when the aren't initialized yet, this is likely the setup key. I also read that even if tags are already initialized, it's still p…

[deleted]

Re: Reverse engineering an e-ink display

#29

Post by redfast00 »

irsagent wrote: post #23

Very well written article. I have been looking for some inspiration to get into hardware hacking and I think this article did it for me. I find it interesting that in most writeups voltage injection is a popular appraoch to turning on debug mode. The aricle makes mention to other class of fault injection attack such as clock glitching or electromagnetic fault injection, but are there other approaches that I could loo…

Voltage injection is (IMO) the easiest attack. There's also optical fault injection, where you remove the black encapsulation from the chip and hit the bare die with a laser (that sounds really difficult though).

On some chips, you can drill into the black encapsulation and find testpads that are not connected to pins on the IC. This is sometimes used for smartphone unlocking.

Edit: Thanks for the compliment by the way, it really made my day that I got someone interested in hardware hacking

Re: Reverse engineering an e-ink display

#30

Post by dutch_scrambler »

redfast00 wrote: post #11
blutack wrote: post #6

Nice article - is the idea to communicate with the tags with their stock firmware using another CC25x series chip or dev board? Unfortunately, that might be tricky without the private keys in the controller. User manual [0] describes a per site 128 bit AES keys used for the RF comms. Might be easier to just write fresh firmware for them - there's some code here [1] for driving the display that could be ported to the…

The idea is indeed to communicate with the tags with their stock firmware (not necessarily using another CC2510, since these aren't made anymore, but that's a possibility). AES is symmetric cryptography, so that should be possible to extract from the firmware. The tags also show a QR code when the aren't initialized yet, this is likely the setup key. I also read that even if tags are already initialized, it's still p…

Ah, I vaguely remember those old price tags as it's been such a long time. To sniff their RF traffic best use another CC2510 and TI's own packet sniffer app. Their RF protocol is an extension of the default one from TI's application notes for the CC2510 so it's pretty easy to read out. The AES key extraction would be useless, as it's using CBC and a unique per-device IV and NONCE is used, that's random, so if you crack one then it's just that once, you won't be able to alter the prices of the entire shop to your desire.

There's nothing too special in the firmware, just a state machine that's sleeping most of the time to save power, and wakes up the device at regular interval in its own designated time slot to listen to the radio briefly if the base station is trying to address it, then receives the pricetag image via radio and copies it to the flash and updates the screen if needed, then goes back to sleep. IIRC, the time slots are, from 0 to 255, with 256 being the broadcast address, and the last HEX byte in the serial number sticker is also its timeslot number.

The only juicy part in the FW, if you can find it, would be the waveform for the e-ink display, as those are e-ink confidential most of the time for some bizarre reason. It's not like there are no waveforms already on the internet for displays like that, but e-ink likes to keep the really good waveforms for themselves and their best customers.

Thanks for the trip down memory lane. Good times.

Post reply on HN