Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Unveiling secrets of the ESP32: creating an open-source MAC layer

zeus.ugent.be

Post reply on HN
Print view View original

151–157 of 157 posts

Re: Unveiling secrets of the ESP32: creating an open-source MAC layer

#151

Post by seba_dos1 »

gh02t wrote: post #131
seba_dos1 wrote: post #56

Earlier quoted context omitted.

> Some of the new ones even have the USB part integrated on chip. Worth noting that this includes JTAG over USB.

I haven't tried the newer ones with USB support since I have a literal stack of older ESP32s to get through for projects, how's support for JTAG/debugging over USB in the common environments like ESP-IDF/Arduino/Platformio/etc? If it's not a hassle to get it set up then I might have to pick one up to develop on.

I'm simply launching openocd and gdb and it works well. But the only way I've ever used Arduino was via arduino-cli, so I may not be the best person to ask :P

Re: Unveiling secrets of the ESP32: creating an open-source MAC layer

#152

Post by lannisterstark »

2Gkashmiri wrote: post #115
lannisterstark wrote: post #85

Earlier quoted context omitted.

You have at least some civil rights in those countries, you don't in China. Be careful of a layover.

civil rights.... haha i live under a literal tyrant right now in india. does it really matter if i have "Civil rights" and china and usa and india is snooping on me? https://www.onmanorama.com/news/kerala/2023/12/02/kollam-chi... here. this is literally fresh off the oven. 26000 people's internet history was looked with a fine tooth comb in order to find that one IP which had viewed tom and jerry on youtube. youtube…

>i live under a literal tyrant right now in india.

>civil rights.... haha

I wasn't even talking about you lmao.

Re: Unveiling secrets of the ESP32: creating an open-source MAC layer

#153

Post by PeterisP »

dariosalvi78 wrote: post #109
RF_Savage wrote: post #94

Earlier quoted context omitted.

They could, but somebody would have to write that FOSS wifistack. You could not run selfcompiled versions of the stack on any hardware that has been FCC certified, because if you could, the certs would be gone once again. Wifi is shared spectrum and devices using are licenced to make sure they conform to the local regulations. One size does not fit all. For example 2.4GHz wifi channel 13 is legal in EU, but in USA it…

So it's perfectly feasible to have an open source Wifi, or Bluetooth or any other RF, stack, but only certain compiled versions are actually certified. I understand that the openness in this case would be limited: you lose the freedom to modify and run the software as you wish (unless you want to risk to break the law), but you can still help bugfix, improve the software and verify that there no backdoors / spying fe…

The law does state that "an intentional or unintentional radiator must be constructed such that the adjustments of any control that is readily accessible by or intended to be accessible to the user will not cause operation of the device in violation of the regulations" (https://www.law.cornell.edu/cfr/text/47/15.15 )

So if the manufacturer makes a device where changing the firmware is "readily accessible" to the user and there is an open source firmware available that can circumvent the FCC transmission restrictions (for example, change the power limits or channel limits for wifi physical layer), then that could be grounds for FF refusing to certify that device, as it is not permitted to make, import or sell general unrestricted transmitters to the general public (there are certain exceptions for licensed operators, ham radio, experimental use by manufacturers etc).

It's similar to other clauses that prohibit manufacturers from making it easy for the user to modify the equipment - e.g. 15.203 (https://www.law.cornell.edu/cfr/text/47/15.203) "the use of a standard antenna jack or electrical connector is prohibited." so that the user can't easily replace the antenna with a different one from what was certified.

Re: Unveiling secrets of the ESP32: creating an open-source MAC layer

#154

Post by BertoldVdb »

127361 wrote: post #135
finnjohnsen2 wrote: post #13

I wasnt aware of this wifi blob. This feeds a tiny paranoia I have at the back of my head when dealing with esp32/espressif. I have dozens of esp32s around and I love them, but Espressif is 100% Chinese. Im uncomfortable with what I read that every company of significant size in China automatically requires CCP party members to be involved in the company at a high level. So Im very happy to hear people such as these…

Some old Realtek switch chips featured a protocol called RRCP[1] where you could write to the hardware registers using a specific type of Ethernet frame. So I guess a CCP-designed backdoor would probably detect a specially encrypted WiFi packet and allow then internal memory of the device to be written/read over the air. The key would be hardwired into the chip, part of the random logic - so there will be no visible…

Many modern Realtek chips still support RRCP. You just need to enable it. For example for RTL8370N: Register 0x18d6 configures the 16-bit key, 0x18d4 selects which ports can use it (0xFF for all, normally only the cpu port), 0x18d3=0x1 enables it.

You can write these registers via the management interface or via the EEPROM. It will not respond to discovery packets, but get and set packets work fine.

This chip also has a 8051 core that can access the internal bus and can tx/rx network packets. To use it you either attach external SPI flash (large program) or write the program into the internal RAM in the chip (small program).

All documented stuff, no secret details.

Re: Unveiling secrets of the ESP32: creating an open-source MAC layer

#155

Post by BertoldVdb »

calamari4065 wrote: post #145
no_time wrote: post #99

the esp32 also has a mask ROM (which includes BASIC for some weird reason). Hence fully deblobbing it is a hopeless battle. https://docs.espressif.com/projects/esp-idf/en/v4.3/esp32/ap...

Nothing about a mask ROM makes the data unrecoverable. It's still Memory that can be Read. I'd be very surprised if there's not an exploit that will get the CPU to barf up the full ROM contents. That's if there isn't a more direct way to read it. Even in the extremely unlikely case that it can't be read programmatically, you can always physically decode it with a microscope and a working eyeball. From there, it's "ju…

You can just read the ROM on ESP32 (or download it, it is somewhere on the website in the SDK)

Re: Unveiling secrets of the ESP32: creating an open-source MAC layer

#156

Post by 127361 »

BertoldVdb wrote: post #154
127361 wrote: post #135

Earlier quoted context omitted.

Some old Realtek switch chips featured a protocol called RRCP[1] where you could write to the hardware registers using a specific type of Ethernet frame. So I guess a CCP-designed backdoor would probably detect a specially encrypted WiFi packet and allow then internal memory of the device to be written/read over the air. The key would be hardwired into the chip, part of the random logic - so there will be no visible…

Many modern Realtek chips still support RRCP. You just need to enable it. For example for RTL8370N: Register 0x18d6 configures the 16-bit key, 0x18d4 selects which ports can use it (0xFF for all, normally only the cpu port), 0x18d3=0x1 enables it. You can write these registers via the management interface or via the EEPROM. It will not respond to discovery packets, but get and set packets work fine. This chip also ha…

Thanks for that, I wonder how many switches out there have it enabled inadvertently, because of a mistake by the manufacturer?

By the way, Some of the Broadcom chips have an integrated 8051, with on-chip ROM firmware. There are leaked datasheets floating around somewhere as well. If someone has the time to dump the on-chip ROM, it would be interesting to see what's in there. Note, some of the pins marked NC in the datasheet are in fact the 8051 UART TX/RX lines.

Re: Unveiling secrets of the ESP32: creating an open-source MAC layer

#157

Post by [deleted] »

BertoldVdb wrote: post #154
127361 wrote: post #135

Earlier quoted context omitted.

Some old Realtek switch chips featured a protocol called RRCP[1] where you could write to the hardware registers using a specific type of Ethernet frame. So I guess a CCP-designed backdoor would probably detect a specially encrypted WiFi packet and allow then internal memory of the device to be written/read over the air. The key would be hardwired into the chip, part of the random logic - so there will be no visible…

Many modern Realtek chips still support RRCP. You just need to enable it. For example for RTL8370N: Register 0x18d6 configures the 16-bit key, 0x18d4 selects which ports can use it (0xFF for all, normally only the cpu port), 0x18d3=0x1 enables it. You can write these registers via the management interface or via the EEPROM. It will not respond to discovery packets, but get and set packets work fine. This chip also ha…

[deleted]
Post reply on HN