Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reverse engineering an e-ink display

zeus.ugent.be

Post reply on HN
Print view View original

51–56 of 56 posts

Re: Reverse engineering an e-ink display

#51

Post by braunboffel »

dutch_scrambler wrote: post #30
redfast00 wrote: post #11

Earlier quoted context omitted.

The idea is indeed to communicate with the tags with their stock firmware (not necessarily using another CC2510, since these aren't made anymore, but that's a possibility). AES is symmetric cryptography, so that should be possible to extract from the firmware. The tags also show a QR code when the aren't initialized yet, this is likely the setup key. I also read that even if tags are already initialized, it's still p…

Ah, I vaguely remember those old price tags as it's been such a long time. To sniff their RF traffic best use another CC2510 and TI's own packet sniffer app. Their RF protocol is an extension of the default one from TI's application notes for the CC2510 so it's pretty easy to read out. The AES key extraction would be useless, as it's using CBC and a unique per-device IV and NONCE is used, that's random, so if you cra…

> e-ink likes to keep the really good waveforms for themselves and their best customers.

Any real evidence for this?

Re: Reverse engineering an e-ink display

#52

Post by dutch_scrambler »

braunboffel wrote: post #51
dutch_scrambler wrote: post #30

Earlier quoted context omitted.

Ah, I vaguely remember those old price tags as it's been such a long time. To sniff their RF traffic best use another CC2510 and TI's own packet sniffer app. Their RF protocol is an extension of the default one from TI's application notes for the CC2510 so it's pretty easy to read out. The AES key extraction would be useless, as it's using CBC and a unique per-device IV and NONCE is used, that's random, so if you cra…

> e-ink likes to keep the really good waveforms for themselves and their best customers. Any real evidence for this?

[dead]

Re: Reverse engineering an e-ink display

#54

Post by kwhitefoot »

mig39 wrote: post #14
dave78 wrote: post #8

I wonder if there are larger implications to reverse-engineering this. When I worked in retail in high school, I was told repeatedly that if a price was marked on a shelf, then there are laws that require the store to sell that item for that marked price. (IANAL so I don't know the nuances there, but it makes sense). If it becomes easy to change these displays with a new price wirelessly, that could be a really nasty…

I once scored a big bunch of coffee because the local Canadian Superstore confused cents with dollars. The price was listed in cents per kg instead of dollars! At first they refused to honour the price, and fixed their mistake. I sent an e-mail with photos to their corporate office. I received a phone call from someone who was laughing and thought it was all funny. He told me to go back to the store, and as much as I…

That's a heart warming story! That head office was amused and honoured the posted price. They would probably have been within their rights to refuse to sell. At least that is the way it works in English law. The price label, etc., is 'an invitation to treat'. That is it is an invitation to enter into a contract, not a contract in itself. Unless it's changed since my wife studied the subject in the 70s.

Re: Reverse engineering an e-ink display

#55

Post by focusedone »

JKCalhoun wrote: post #26
focusedone wrote: post #3

I'm so happy there are people out in the world able to reverse engineer things like this and share the results publicly. Freakin' cool.

Yeah, waiting for them to finish up so Rob Cockerham can go into a COSCO and have some fun slightly altering the price tags.

Hadn't thought cockeyed.com in a looooong time - thanks for the throwback!

Re: Reverse engineering an e-ink display

#56

Post by outworlder »

JKCalhoun wrote: post #26
focusedone wrote: post #3

I'm so happy there are people out in the world able to reverse engineer things like this and share the results publicly. Freakin' cool.

Yeah, waiting for them to finish up so Rob Cockerham can go into a COSCO and have some fun slightly altering the price tags.

Unless they find an actual exploit, tag communication is encrypted. They would have to be using the same key. If not, one would have to swipe one of the keys, reverse engineer like this, and extract the key.
Post reply on HN