21–26 of 26 posts
Posts like this are the reason why the internet and software development felt magic to me as teenager. This stuff still is magic to me. Wonderful work!
Posts like this are the reason why the internet and software development felt magic to me as teenager. This stuff still is magic to me. Wonderful work!
Same but too late I realized almost nobody hires and pays for this type of fun work and I have to do stuff I hate, like migrating pipelines from Azure to Github, if I actually want to pay rent. And now AI can do both the unfun migration type of work and the fun reverse engineering work.
Eventually, you make contacts with the technical teams at the big companies and then you start applying....it's a long road, and I have been making audio electronics from scratch since I was 10.
I'm finally making those big industry contacts though, hoping to get in with either Kustom\Hanser or directly into JAM in Alberta (because I'm done with this country)
If I were an alien and saw this, I would run. Terrifying. My brain hurts any time I hear about a completed hardware hack, but this write-up just takes the cake. My experience with hardware RE is limited to a class project hacking a cheap router, and there even after 3 weeks I couldn't make sense of the can of worms that is interfacing with JTAG using OpenOCD. It's like looking at bats and then shouting into the dark…
It is so easy to use signature verification and even encrypted XIP with Mcuboot it just blows my mind that companies don’t. Also the level of reverse engineering here is kinda bananas. I almost don’t believe he was able to find the transfer functions for the dsp bias equations w/o some source guidance. I mean that’s just bad ass if he did it without help.
Why should they lock their customers out of their own devices?
If I were an alien and saw this, I would run. Terrifying. My brain hurts any time I hear about a completed hardware hack, but this write-up just takes the cake. My experience with hardware RE is limited to a class project hacking a cheap router, and there even after 3 weeks I couldn't make sense of the can of worms that is interfacing with JTAG using OpenOCD. It's like looking at bats and then shouting into the dark…
You read your chips' datasheets that go in detail on pinouts and protocols. You use logic analyzers that capture signals and programmatically decode a multitude of protocols from those signals. When you don't know what are the pinouts or protocols, you compare against similar enough known ones, or bruteforce them. Some examples: * Once you've learned a few chip pinouts, you can pretty much guess unknown pinouts just…
I agree with but extend your last point about breadcrumbs - it's not just that write-ups are hard to find, it's that even several great write-ups for adjacent projects may not be sufficient for a beginner to synthesize a path for his specific project. I spent a week watching YouTube videos and reading in preparation to dump the router firmware, and it still took me 3 days before I committed to actually soldering the wires to the UART contacts - the videos all had header pins! (Sounds dumb, but I'd never permanently altered hardware before.)
In case people are curious, the router automatically gave me a root shell when I accidentally pressed a key during startup once I was connected to UART (using a [programmer board](https://a.co/d/0aVp22Mq)), and I was able to dump firmware using `dd` on one of the device partitions labeled "firmware", then `netcat`ing it out.
I also tried dumping the SPI flash chip directly using tiny alligator clips and flashrom, but I think I literally didn't know to build the latest version of flashrom from source, and so couldn't connect. Maybe same issue with JTAG - old software couldn't find my new programmer board. But I wouldn't have known what to do with gdb access even if I had connected to JTAG! Oh, I also didn't know that I needed to solder together the 2 pins that were specified by the datasheet to activate JTAG - thought I could just hold a wire between them like stealing a car in the movies lol.
Final example of "no breadcrumbs": I wanted to modify the firmware, then flash it back, but I couldn't for several days and the life of me figure out how to repack the firmware after using binwalk to unpack it. Ultimately I flashed something badly formatted out of desperation (maybe wrong size??) and bricked the router. Every guide mentioned "flashing back", but none showed how to do it - I am actually still curious haha, what was I missing?