How about glitching a write instruction to overwrite the copy protection register instead?
Reverse engineering an e-ink display
31–40 of 56 posts
Re: Reverse engineering an e-ink display
#32How about glitching a write instruction to overwrite the copy protection register instead?
Glitching a write instruction is a little dangerous. But if you have many chips to try or can live with an incomplete, possibly corrupted dump, feel free to do it.
Re: Reverse engineering an e-ink display
#33How about glitching a write instruction to overwrite the copy protection register instead?
Glitching a write instruction is a little dangerous. But if you have many chips to try or can live with an incomplete, possibly corrupted dump, feel free to do it.
Well, the exploit could be perfected on the device that can be reset first. I understand that writing a wrong address can have unattended consequences, but the read cycle should come first, and glitching likely affects the address decoding circuitry (as opposed to the SRAM registers), so it's probably hard to miss.
I understand wanting to play it self though.
One thing comes to my mind though: each board likely needs slightly different timings.
Re: Reverse engineering an e-ink display
#34I wonder how popular this tag must be/have been to be able to find someone that had already dissolved/sandpapered it? Can't wait for the follow-up on this, turn that e-waste into something usable!
Kohls has used tags like this for years. I guess it makes sense if you are actuallly adjusting prices daily
Re: Reverse engineering an e-ink display
#35How about glitching a write instruction to overwrite the copy protection register instead?
I had also thought about this, but this is much harder to pull off, since
1. You need a lot of instructions in sequence to succeed, enough that the chance that all succeed is very very small (recall that there's only about a 5% chance we execute an instruction correctly, if for example there are 10 instructions you need to execute, the chance is 0.05*10). If you write to a wrong location because an instruction didn't execute, you lose a byte of the flash.
2. Before writing to flash, you need to stabilize the clock of the chip (this is also done with 8051 instructions). For this, you need to wait until a register value changes. This is feasible, but an additional hurdle.
Re: Reverse engineering an e-ink display
#36It still somehow breaks my intuition that it’s cost-effective to have thousands of these deployed in each supermarket. I mean, I do understand it rationally, but it’s still weird.
What happens if you see a product with price X and by the time you checkout it has price Y? Can you claim somehow the previous price?
Same could happen with paper tags while they are in the process of updating them.
Best solution would be to have a transition period where for x hours it’s at the lower price in the system.
Re: Reverse engineering an e-ink display
#37I wonder what the motivation is the attempt to use the stock firmware and reverse engineer whatever communication and potential key signing the device has from the factory, versus just wiping the flash / desoldering and replacing with completely new firmware from scratch.
That would require completely tracing the PCB out to understand the display drive from the uC and other pin assignments, but... I find that much easier. And then the end result is the potential for a completely understood hardware & software configuration.
Re: Reverse engineering an e-ink display
#38I wonder if there are larger implications to reverse-engineering this. When I worked in retail in high school, I was told repeatedly that if a price was marked on a shelf, then there are laws that require the store to sell that item for that marked price. (IANAL so I don't know the nuances there, but it makes sense). If it becomes easy to change these displays with a new price wirelessly, that could be a really nasty…
I once scored a big bunch of coffee because the local Canadian Superstore confused cents with dollars. The price was listed in cents per kg instead of dollars! At first they refused to honour the price, and fixed their mistake. I sent an e-mail with photos to their corporate office. I received a phone call from someone who was laughing and thought it was all funny. He told me to go back to the store, and as much as I…
Loblaw can definitely afford it.
Re: Reverse engineering an e-ink display
#39I might be missing something. I've seen other reverse engineering projects where they simply unsoldered the flash memory and read out the contents. Wasn't that an option?
Re: Reverse engineering an e-ink display
#40I wonder what the motivation is the attempt to use the stock firmware and reverse engineer whatever communication and potential key signing the device has from the factory, versus just wiping the flash / desoldering and replacing with completely new firmware from scratch. That would require completely tracing the PCB out to understand the display drive from the uC and other pin assignments, but... I find that much ea…
The person who brought the tags has a lot of them, more than the 3 they donated to Zeus. If we replace the firmware, we have to do this for every device, which would be a lot of manual work (opening case, adding probes, flashing firmware, ...). This is even more work per device if you have to desolder the uC from the PCB and solder something else to it.
Reverse engineering the communication protocol is a lot of work, but only once. After that, you can talk to stock devices, without having to modify their hardware or software.
I also didn't find any datasheets for the e-ink display or how to control it, so here also the stock firmware can come in useful.
Aside from practical concerns, I won't lie, I also took this path because it's fun to do and I could practice hardware hacking.