given the choice between being right
before lunch and right after lunch I
always go over right before lunch
because then like arrows really excited
in your talk instead of all I sleep in
it because that's what I do after lunch
so I have to apologize I have a slightly
hoarse voice my kids were sick three
weeks ago and still I have a hoarse
voice and it didn't help that I've been
speaking the past three day four days so
here I am this is seven armor hacks for
seven GBP Great Britain's I repeat it
today our own food bread with BP BP rich
pounds what in seven pounds seven bucks
seven dollars good work boys hey boys
seven good work points will get you a
bunch of hyrax so let's get on with this
where's my there's no my pictures on
here I'm Joe Fitzpatrick I do our
marketing and training and I have been
doing this for six years on my own prior
to that I worked at until the company
about the community and I was working on
a silicon debug so always use they come
off the line figuring out why they don't
work when they don't work and how to
make all's been faster from that I moved
into product security so I was doing
God's desktop and server CPU pen testing
pre pre-release pre silicon and masovia
I got more of that and wanted to travel
a lot more so I decided to start
teaching classes to Ron's and people so
Gordon and Omega and others have haven't
told me many times that I should come
here to degree station for several
layers and so I might actually be here
finally I just so happening tonight
class this weekend Edinboro so I have an
excuse to the eros excited it happened
to be the same week so I'm leaving up
were taking varsity this is right off of
a little search help thing that Google
gives you and I was pretty excited to
see notable alumni there I am right at
the beginning this is before I agree my
hair I actually have a Google Alert on
my name so I can see like when things
pop up quick and I get a lot of hits for
members of Scottish Parliament and
health ministers who have lots of things
to say about organ donation and
everything else but it's kind of neat
because you know Joey Joe Fitzpatrick is
always in the news but what I'm gonna
talk about is poverty and tools for
hardware hacking anybody seen this
before what is it who loves the bus
pardon I eat my spire can't stand it so
about ten years ago or so when it came
out it was pretty cool you could infer I
think it's 30 35 bucks I don't know what
it is in your money or we're not getting
your money in a month because who knows
but for $35 you have this little device
without a micro controller on it this
one right here the usb-to-serial
chip and then right next to it this
is a pic microcontroller and that pic
microcontroller would basically speak
all sorts of different protocols that
you might want to speak it could listen
and tell you a ratio of cable what's
going on it was designed so you wouldn't
have any software under computer you
could just use a serial terminal and
talk to this thing so at the time it was
pretty awesome
there was no other tool that would do
some other things for that for even
close to that price range if you want to
do anything anything fancy looking at
the signals or observe things you need
something like this fancy Windows XP
running logic analyzer right these
things are you know if you're a student
at a university and you have an extra
lab you might have access twenties but
if you didn't you had to beg your
friends or find someone I wouldn't work
or something else together your hands-on
with these devices because they cost you
know thousands if not tens of thousands
of pounds or euros or quid or dollars or
whatever but something on that order of
magnitude probably even higher on like
wasn't Zimbabwe dollars it was probably
like you know a few a few trillion
Zimbabwe dollars anyway recently there's
been these new tools these Sayle a logic
analyzers and this is about an inch and
a half two inches or what's that you
know five centimeters on the side these
tiny little devices they have a bunch of
wires these are logic analyzers that can
hook up to your signals so these things
cost closer to about a hundred dollars
right so we have a big difference in our
tools but still 35 dollars for a bus
parent it's kind of the best way to go
logic analyzers on bench top it makes
sense PCB ones suddenly sorry PC based
ones
suddenly make things a whole lot more
accessible so I'm gonna be using this
board for quite some time this is a made
by Adafruit and that's a company in the
high states that that builds these like
hobbykid puppy more things what's
important though is on top of here is
the FT 232 H chip right
and empty the company name FTDI 232
comes from rs-232 because these things
used to speak rs-232 and not just H
because this thing is the high speed
version and can do more than just parts
232 it can do chain ten again can do spy
they can do all sorts of things and
we'll see that they you can even sample
and output Dana and up to 30 megabits
per second which is would be asking for
a chip that cost at least in the US
would cost 15 dollars
who knows where it costs here maybe
maybe in here you can get them here for
under 15 euro oh yeah
so anyway I said 7 pounds that are 7
good point points right and absolute
more but luckily you can go to all they
express which is this you know warehouse
of everything you ever wanted to not
work from China or everything everything
you you would want from China but would
hope to be a slightly better quality
than their actual gonna get it for seven
dollars and forty four cents you can get
these things and like at least for me
it's dates until about six months ago
they're never there really wasn't a lot
of duties tariffs on stuff coming to
China I don't know if you follow the
news but there's a full framework thing
going on and like tariffs and all that
crap but I think you guys got your own
news to deal with so I understand so 7
paths have a good point points or 7
dollars you can get forward it's based
on the same chip and some when we talk
about things that we're gonna do we're
not dealing with the door doesn't matter
eyes purple or blue or red or anything
else we're gonna use USB to talk
directly to that ship and use that ship
to talk directly to tires right so I
thought it'd be pretty cool since like I
use this chimp so much I contacted FDI
FTDI that occurs in Glasgow so I said
hey I'm teaching how many have a
presentation at a university in in
Scotland and I thought maybe you guys
would donate a whole bunch of cable so I
could give him out after conference and
of course they said no and that's
okay well can you tell me the procedure
how I would request academic donations
in the future and suddenly that that
went down the right path and said well
we we can do that we can send you some
cables good yeah that'd be great like hi
leaving Oregon which importantly which
is literally 20 minutes from their US
headquarters and here you're an hour
from there you know worldwide
headquarters we have to figure out how
to get these cables right weeks go by
right I left and I've been in the UK for
the past week so I can't get them in a
month and they finally get touch with me
like hey you know sorry we dropped the
ball this you still want those cables
some I'm sure you know you can send them
right to the University but okay well um
you know we'll figure that out and they
like go back and forth for three days so
yesterday they shipped a whole bunch of
cables overnight supposedly to here but
they were supposed to arrive at noon I
have no idea where they're to end up if
they're animating here last I looked
this morning they were in stance an
airport they were also kind enough to
use my FedEx account number to ship
those cables overnight from right down
the street from my house so
you know we could call this a sales
picture graph TV acts I'm telling you
how to use their boards we could thank
them for donating those cables really
nice of them but the you know whatever
this is being recorded maybe they would
give me the next time and save me the
time so I said seven it should I adjust
microphone is that feedback okay we good
okay
and here are the seven scenarios I'm
gonna walk through so using an FTA
FTIL a pro logic analyzer with sing rock
or an ease that you are or console
access to go directly to talk to a
single core computer and then will use
it when those TV another tool that
supports this ft2 30 to show to do James
had control and manipulate the live
running system then we use a flash mob
for two things the first is to dealt
with the firmware off of a system by
dumping the firmware we can get a copy
of all the code running on it we can do
some offline analysis if without fancy
we can go and manipulate those files and
then flash them back to the same system
and put it up back doored or with Lucian
else or whatever you know fund something
more I put on there and in the last two
bits
we've got using it to do VIP I squared C
I squared C is a protocol that's used
for configuration of lots of tiny ships
actually the FTDI itself uses I support
so you configure itself and then in my
name crafting packets talking about how
to use this as well raw output device
for we can tell what the ones and zeros
would want to come out and write so I'm
gonna take a sip Waterson to my voice is
going great
this is a hoarse voices is an American
accent a cylinder so first we've got the
FTIL a the API holiday is a driver for
Sigma Sigma is an open source logic
analyzer platform so I mentioned before
we have those salient logic analyzers
and they're pretty cool
the problem is you know it's a rant
about more companies they have an office
of logic analyzer you could get 460 US
dollars with a student discount it was
four channels they did most of the basic
stuff it was really solid really
reliable and had pretty easy to use
software so what they do they cancel
that product and then they double the
price of all their other products so
their machine this one is $400 so how
many of you four dollars to buy logic
analyzer right now yeah so it just here
it bothers me because I'm trying to get
people to start doing this stuff so FTDI
la is a driver to use this as a TI where
has a logic analyzer so what I've done
here is I got my board I don't have the
seven pound the seven dollar won't have
these because I have just tons of these
actually about 30 of them with me for
the classes I'm teaching this week and
we forgot a bunch of wires to this
header on vigeland on a Raspberry Pi
here so I took the Raspberry Pi just
because it again I have a bunch of them
has aids in for classes what we want to
do is what I'll listen to what those
signals are doing right so it's an
electrical observation room and what we
can do with the software is we tell it
to connect to this FTDI to 32 H and then
we go and tell it to Hampshire 1 million
mo this is actually the previous hops
reckon what we really want to do is
capture a few million samples at about
one megahertz right so we go click run
it'll go and capture data so we'll get a
whole bunch of ones and zeros if we look
closer at this data will see that the
day that goes up and down and
that state of being spit out on these
pins so now we can use the logic
analyzer to interpret and figure out
what it's doing what it's communicating
what it's saying I think now this
program is pulse view pulse view is the
front end the graphical front end to
sing rock so we can do this all in
command line if you're really you know
sharp I'd like to command lines or we
can do it with a nice graphical display
we can then go and use this option over
here because our protocol decoders right
so it's just a matter of details about
what these things are doing if we know
that we have a serial protocol we could
then go and apply protocol decoder and
tell that we wanted to code the data
here we want to interpret the ones and
zeros and zeros and ones and turn them
into bytes right so right now we have
the ability to measure a signal observe
and understand more about it this is
great for finding quartz than the chip
is communicating on this is great for
listening between two chips that are
communicating to each other it's just
really happy to do so most of the water
I should you know drink we got time
already more to drive down so don't
worry good I should a chef set of shots
of whiskey right for the seven you know
that's good good to clear throat too
isn't it
yeah I don't know sorry so serial
console so we matter raspberry pi we're
just moving around and had a few wires
it just so happens that
this is your this is a serial
communication where the Raspberry Pi is
telling us about the boot process it's
giving us all the things that happen as
it loads the kernel those drivers and
then it shows us a prompt to what we can
do stuff so it is the exact same or and
we're just going to use it both people
to command money here we're going to use
it using the tool called screen is there
anything anyone ever used screen before
okay have been in the same way
everybody's screen to talk to a serial
killer before okay good apparently
screen also has other uses too this was
news to me a few years ago I have been
using it for over a decade
to talk to serial cables and then I
found out it has other purposes where
you can have multiple terminals and all
that fun stuff
but anyway screen and what we do is we
need to tell it to talk to the cable so
we call it dev on sonic system TTY USB
zero and we also have to have the speed
we want to talk we don't know with you
are what speed it's talking until we sit
there and look at it with a logic
analyzer which we just did so we just
happen to know that this is one one five
two zero zero bits per second right we
do that and suddenly we get data we have
text running right on the screen so
again sometimes you'll do this I know I
know straight twos I originally wanted
to do a bunch of demos with this but
then I realized that my time was kind of
limited so I just screenshots instead so
now I'm thinking like oh if I if I just
was about figured out how to get that
document camera but I'm not going to do
that because then you'll all be bored
watching me try and make wires work but
hardware is actually easy it's not that
hard just ask for em later
so what will happen is we'll run this
and it'll give us all the stuff and
finally the very end it may or may not
give us a promise to log in which is cut
off from the botanist so we want to log
in
sometimes it
a your route you get this little pound
sign and you get a prompt or a colon or
a spatula me and it tells you pay your
route you do it everyone all these
commands are available to you it's fun
times other times it's really obnoxious
Senate LOC to you and it's a different
user sometimes it's really really
annoying and asks you for a password
like what do you do they like I don't
know the password them you can sit there
and write a script that'll try under
passport that's no fun so we might have
to find another scenario another way to
get into a system like that
one option is JTAG so who's used a JTAG
before right so James had is the joint
test action group right so this is where
all the joint testers get together for
some action where they talk about how
they want to test their work so it's a
it's a - a standard it's designed in the
80s for more testing to make sure your
boards are hooked up together but every
device had a tap and a test access port
to use this more test feature so what
maybe factures did i've CPUs and said
hey we want to be able to debug our cpu
as well let's add those commands to this
interface so how it comes is to open OCD
so that's not OCD what you're thinking
it's on ship debugger right so it's open
source which means that if you want to
read any documentation understand how it
works at all you have no choice but to
read the source code which is residency
sort of so anyway of open OCD looks
familiar
we've got the same or USB cable or in
the system I have this little wire
harness I didn't cut the wires to
different pins this time right every
device has different debug pins that are
dedicated and I actually did Sheila
wellness when I had to go in there and
change some software configurations to
enable JTAG right JTAG is a debug
feature we don't usually use it in
normal operation we only use it when
we're testing it so manufacturers you
know like they really when you're
designing a chip it's more expensive to
have a pin and
to have more function inside the silicon
so they try to minimize the number of
pins so they have multi-purpose pins so
we told those multi-purpose pins to go
back into cheytac boat so we could go
and miss from our system next there we
go
so what LCD is the tool we're going to
use we'd use a - ax command to like
include a file in the first file we have
is ft - 32 H about CFG this is the
configuration file that tells us where
to find this FTDI work what can my sandy
it looks like and just some details
about how we're using it and next we
have raspberry pi Don CFG this is a
configuration file it tells us that we
have an arm 1176 processor and it has a
certain amount of memory and other
features so in fair telling open OCD
details when our heart we start of an
OCD it goes to our source our adapter it
looks around finds a device twice as
identified with a code and it's
recognized as a broad common part just
like we were talking before we were
talking about the less expensive and
more expensive ft 232 boards they're all
the same know of the same chip on them
right when it comes down to coding and
working with it
but we care about is the manufacturer
and so again same thing comes when we're
talking about using J 10 right we're not
talking to a jade Raspberry Pi with
jtech we're talking to an Arrancar arm
1176 processor doesn't matter whether
it's on a Raspberry Pi or a zero or
inside of a flip phone from the 90s
which is where that processor belongs
but anyway we find our break points or
watch points we have our ability to go
and debug our heart now how many of you
have used GEB before right it is GB to
debug up process right so you attach to
a process you use genie you can you know
x10 I show 10 instructions at the
program counter look at the contents of
memory need stuff like that well that's
exactly how it would OCD work so you can
start up GP instead of telling it to
attach to a bid process ID number you
tell it to attach to open MCD and then
you're directly using your hardware to
go and debug this is your using your
heart hair JTAG adapter and debugging
the hardware on this little board
reading Cheers
so next flash wrong don't thinking
further so people talk about dummy
pheromones you know I just don't confirm
one we'll deal with it later like I've
scrapped the framework and really if
you're a software person your goal is to
get code to look at right if you're a
software person looking at an IOT device
or network adapter or a webcam or
anything like that once we get the
firmware off of that you've taken this
Hardware tissue and turned it into a
software issue right so I'm a hardware
person that means when it's a software
problem someone else's problem so I love
getting firmware off with devices and
handing it to someone else to deal with
so flash Brahmi is a pretty pervasive
tool it's very common inspiron most
distributions it can be flash using
about like 30 different pieces of
hardware so there is the FT 232 H we're
going to use we've also got a handful of
other devices made by commercial
like a maze SF 600 visit Eddie Brock
teddy frog assist uh you know if you
want a dollar device that does basically
the same thing that lets you talk to a
flash chip so we use flash foam in this
case we'll wire up this is a Wi-Fi
router I've been dealing with and we
have a CPU here it has memory and right
over here you can see my green I'll
change to then right here we've got a
flash chip it's a little 8 pin ship his
stores eight megabytes of data but that
eight megabytes of data is enough to
install to store a bootloader a kernel
the root filesystem and a little extra
space to spare if we're using modify
bugs so what we'll do is we'll click to
the pins of that Shin right we can look
for the datasheet of that chip to tell
us which pins to globe to and again
saying or say USB cable to our system
and we just have to use the right
invocation to make magic happen what
we're totally here we have flash the
home is the program where Tony to use a
specific program and it's the FT two to
three to underscore spy program so FTDI
actually makes a whole bunch of
different ships they make the two to
three two then four to three two and the
two three two and just matters how many
ports they have on them so I use the two
three two H's the cheapest and smalls it
only has one port the two to three to
Asian has a basically two of those chips
sandwich driver what makes of silicon
how the floor has forth and I don't know
why you a USB cable with four serial
ports but hey so the most actually I can
think of a few good reasons but anyway
and then what we tell to do oh we have
to tell it what type because again we
have variants of this chick they all use
a similar driver in and cliquey to
clarify that as a - 30 th version and
then we want to read so we do the - are
and the file we would write it - okay
flashlight it was
and this is this doesn't happen the
first time ever right it goes says Oh
detective Hart
we found a whit bond flash chip and
we're gonna pump it we flash never done
this takes a few minutes when it doesn't
work it gives you all sorts of errors
sometimes it says we found a flash check
we don't know what it is sometimes it
says we didn't find a flash chip but
whatever ten there's a flash chip there
and give you a lot of cryptic error
messages but not me to tell you what's
going on again open source tools if you
want to learn more about how it works
you can either wait the source code or
do what I do and took up your logic
analyzer to outlaw it works so you can
understand what the heck is doing
because it's hard to read logic
analyzers for me are easier to read
anyway we did it we don't we got our
supply done hurried out but again I said
once we get firmware we had enough to
stop for people make a deal with it but
it's still not in that lease for me so
what we can use is a tool called pin and
lock okay this is a great tool basically
if you ever use the file command file
looks at the Ruby a notepad and so know
this looks like a PDF or a zip or a JPEG
or text file or code or an elf and then
walk way so that walks through an entire
file and looks for the beginning of
files in different intermediate spots in
that file so let's go walk through this
and say oh I found a document Federation
of Lachman footer so maybe I found an
HTML file on there I found a copy
registry because you're actually
interested in those ones use a couple of
kernels right we have this header block
header image we're gonna break it down
and say go this is the Linux mips kernel
that's gonna follow me here and here we
have healthy and make compressed data
knowing that it's also makes me press
day that means that this tool knows how
to decompress it so there we go we got
the kernel press
like walk through and look at all the
details in it sorry it's a good thing
I'm not handing out cables because that
I have to delay them so LZ may compress
colonel we also have a couple other
things tell me here we have a squash in
Venice Anna jf4 that's two file system
these are the file systems out all the
details all the extra files in addition
to the colonel to make the system run
whether you show here is there's a - key
option and it guesses extract so I'll go
and extract all this cool stuff that
I've found isn't that handy so we going
to track these files but I chose to do
is extract the Oh
this time is off that's why I'm sorry
the clock on here is 10 times fast but
it's ok because we're doing good - II
extracts him what I'm going to do is I'm
gonna look at the squash fest file
systems and there'll be a full root
filesystem
so it'll have an Etsy directly and it's
like that see directory it's gonna have
a use of the files all the fancy files
are what modifies go and give us sales
privileges on this so who's familiar
with Linux ten knows what files we can
modify to give ourselves privileges it
guesses back the room where our
passwords stored online sister okay so
that adds a password of show some source
user information and NC shadow which
stores the hash passwords we have access
to those files if we wanted to we could
go - is but
that's no fun that's for people who you
know don't want to buy anything like
Bitcoin anymore
we're gonna go create we can go and we
can modify and put our own cash in there
we can press it and send it back we can
go into the password file and go and say
oh there's user I not a login it's user
but change users user ID to zero and
then when you login as user here's your
root but we're gonna do is we look at
this in in tab basically a whole bunch
of the initialization programs can't run
this isn't open wrt which is a
distribution of Linux caters
specifically for $5.00 and right here
might ask for a console
I'm gonna run big log in fashion user
like ah let's change that let's change
that to - America root okay so wouldn't
it be nice to just turn it on like an
image ask for a console here is your
console it sounds like a good deal right
so what we can do is we can take this
file system these two old make a squash
address right so squash this is that
compressed file system we can't just
mount it we have to go and extract files
from it and then pack them up it's kind
of like giving a file you have to sift a
copy of your file system so we'll use
makes part of this and we use that to
rebuild a firmer image that we can flash
back to our voice with gosh wrong there
are other tools than classroom to do
this and actually this other tools are
in my opinion better than flash ROM but
everybody seems to want to use flash ROM
because every time you use it your honor
I ain't going back to flash around all
the time because it's always there it's
always on every disk Linux distribution
and every other like custom tool I come
up with I have to support and I don't
want to support my students
I go so let's talk about writing
firmware it's really tough
basically we take the same exact command
line and change the R to the W pretty
cool right
say why are a single comes to same
everything we've just taken a dump we've
gone and modified it changed a couple
bits we packed it and now we're flashing
it right pops the same device okay
so we came back and what it would let be
for there's no areas same set up let me
let me clear up some of my clutter
so we can look close quite a lot more at
the system you'll notice there some we
are wires
I give us an income that's not factory
okay although I've seen similar factory
type jobs in sketchy hardware so what
happens is this CPU always want us to
talk to that flash chip right so in
order that make all this happen we have
to tell the CPU to show back up right so
what do we do we want to tell it to be
sad just stay ressentiment
keep resetting it tells time sometimes
you're lucky to get a recent modern
digital that down the whole time well
the system didn't have that so what I
did is I will look to this chip I found
out that this wire right here is the
reset wire and I hope that over here to
a jumper where I pulled it to ground
alright and you know it's a little ever
raising epoxy not pop it on there hold
it in place because if you hear there's
something more than once you should do
it right right so hot glue that's the
right way to do it right
way better than duct tape and I also if
you're ever tempted don't use Krazy Glue
it just makes a mess of everything the
worst part is crazy little get
underneath these little pity little pins
and then the next time you try to use
your own pro clips to clip onto them it
won't be able to get around the back of
it then they will fall off so don't you
crazy work hot glue
okay herb for a cough drops um anyway we
flashed it back
Cyril had a policy report right there we
can hook up our that TV on board to talk
to that we watch the system that and we
can see what we successfully did we end
up with a root shell simply don't get so
far oh excuse me next flash whoa I'm
writing with W now modifying exports
account configuration so I don't
actually have the photos with me here
because all of my sorority stuff is they
don't like ask at home in Oregon so I
don't have any surveillance cameras that
I can get a good shot so what we have is
I squared C configuration and if we look
back at this device or it'll look very
closely at the back to the eye board
right and we see there's this big chip
here that's the FTDI where we have some
LED I'm sorry crystal that gives it a
frequency oscillator we've got a couple
of LEDs over here oh then we've got this
other black ship all right look it it's
got six pins it does something right
this is a serial prom that's pretty
awesome right sorry
so I'm going to certainly promise this
is a no chip that holds a couple of
bytes of storage so that that class
shape you talked about before was by
eight megabytes this is like every
twenty eight months that's all what
happens is when this chip power zone on
it goes and talks
says hey Who am I and this chick says oh
you are a cm Jenny's cjm cu-ft - 32 H or
if your fancy it says you are a native
fruit ft - 32 H so when you pop it up on
the screen where you love it you're the
driver shows up and says you have
attached ft to 32 H it gives the name of
the manufacturer to Sam for release and
we have something like that is because
whoever this buff pirate like this boss
party is very similar to that's actually
ft 2 3 - oh all right that means it's
slow it can't do anything but you are
but when we plug the bus card in and
says hey you have a bus firing sounds
good right it says hey everyone
there's a little flash chip right there
that tells it it's a bus part right so
if you're a manufacturer of like I don't
know a USB microphone or something I
don't give an example tell me I get this
bomb USB device for that ft2 graduation
so I got a little radio dongle fur like
a dr. white right you would speak USB to
the serial cable that serial cable a
serial protocol to the actual hardware
but you about this device to say hey I'm
a Mattel or I'm on you know Sony or
about some other brand device I don't
want to say I'm an I'm not I don't have
to yah device I am a branded device
anyway the point being we can go in and
speak the protocol with this piece we've
got to hum this tool this library called
live and PSN see right which is an
abbreviation in that great for something
I don't remember what I never do but
it's basically they're after
as high as the interface for you to go
and tell what things you want to do
whatever you want them to do it so with
this we say over have my advice and
we're gonna set some hands high and some
things low achievement maybe this is the
wrong one sorry
they don't know I'm talking to the wrong
sign adamant order so we have NP s SE
and we have a bunch of I squared C
commands that we can do we can have an
acknowledgment we can write this we can
get acknowledgments we can read bits
right so it basically have an API built
into this and then it's funny this this
is to limp esse it's a bunch of rappers
and a NPI it's written by the same guy
who writes Ben walk so he really knows
his stuff
Greg Heffley you should follow him he's
like I think he's at dinner TT ys0
on twitter so you should follow him he's
smart and what we'll do is we'll say hey
we're going to talk I squared C and 400
kilohertz and let's go start writing
game to that or we need a nerf Roman we
have that communicate with that shape we
can change the configuration on my chip
and suddenly we turn our whatever we
have our our our our not half C n J's
MCU ft 2 into H we can pretend it's an
Adafruit we can pretend it is any other
manufacturer that makes a board based on
the same chip and last thing that I
mentioned was that back at the custom
protocol who knows what mid-90s
[Music]
so up to this point I've been talking
about the existing protocols I talked
about mache tank I talked about your I
talked about spy and I swear see you can
go and like look for our time diagrams
an ideal scenarios we find chips that
support these protocols but sometimes
you encounter protocols that are
different rarely but you do and usually
when you're calculus because some did a
poor design job but anyway sometimes you
want to see a different particles so I'm
going to speak
protocol differently so if you wanted to
mess with the timing on your spy
interface and he wanted to start like
doing maybe even glitching or something
like that
to try and get readouts from uh from a
flash device right you would want to
have very fine grained control for when
your signals went to one or zero or
anything else so what we can do is we
can use the bang mode right and what we
do the same using one GPIO mother's
children purpose input Harley so
basically we have a bunch of pins on
this device we can tell any one of them
to be an input or an output and if it's
an elbow we can tell it to be a 1 or a 0
high voltage or look voltage right so as
a great wise friend of mine once said
once you can turn on/off an LED in
hardware you can do pretty much
everything right so so basically it's
all a matter of timing when you turn
those on it's one off so the combination
of sending your Penn State's high and
sending your Penn State's low I'm sorry
pick high and him low
and do it as precise timing that's all
it comes down to right once you have his
ability to do this in software you will
have a little protocols at your disposal
[Music]
almost on so here we go seven sevens
scenarios one through seven things you
can do with a 15.7 could boil each board
or may eat a few years of their tea
arrow or I don't know
you can you can use a logic analyzer
with a software sing rock if you need to
on your console access you can use it as
a JTAG control access depot
kaalia chip right we can use firmware
dumping and writing reading and writing
to mail in a system and we can also do
some configuration is promising a
configuration of various devices and if
you need to you can always craft your
own custom custom protocol from scratch
in software very tediously of course
you're not doing this with just a piece
of hardware there's software that
supports all this so these are tools
that I use on a regular basis I find
them to be quite reliable each make if I
have my complaints about them I got the
same rocket open-source logic analyzer
framework pulse view is this graphical
front-end screen is this multi-purpose
oh sorry no consoles it can speak to
your serial cable
it could speak to you know whatever
brightness your cable or your go to a
few arts or anything else
open OCD is another open source to it
because you're on shape debugging it
lets you control the bugger with JTAC or
even sswd single our debug flash bomb is
the flash reading writing Swiss Army
knife it works with this it works with
commercial tools you can even use flash
ROM on your laptop to make rice off of
your laptop or PC or everything else
they walk it's a great tool once you've
got that firmware image to go and break
it down into pieces so that you can make
sense of it so you can hand off of
software parts to the software people or
it can just mess around with text files
and that's why your skills are like
money and lastly there's a library live
at PS NC which lets you have kind of
Python or C API interface to control
events that are coming out of this board
which can be really handy has to go into
the scenarios where you have these
non-standard verticals
any questions better manufacturer than
the one from China yeah I would have
been someone experiencing
probably when I were stuck behind
quantity from from Aliexpress I expect
to get my 10% failures an order from
Adafruit
if that happens I just sent them back at
the Seminoles there are my go-to tools
and that's what I have two devices I
prefer these and more expensive hands I
will say because I caught up an ENDIF
hey what about the thing I did with it
if I'm tailor the system and I want to
find a serial console on our cheytac
kids and they're hard to find
I would much rather take a $15.00 door
and why are not once and leave it with
that system and never taken apart that
everything take it off until my $15 for
a used on this board and this board
because I'll go back to that same work
you know in a week and have to go spend
a half an hour finding those pins again
because I'm really bad at documentation
when I could just leave that 50 probably
more attached even more so you can get
serial cables that just to you are for a
dollar to like there's no way then it
makes sense to ever disconnect Asiri
cable once you've got a connected
working in my opinion so that's where
you set me into the next level of
complexity right question is like what
happens if you have like I we don't
protection or stuff like that so again
that's where you have to find out more
about the check you're targeting we're
dealer with a spy flash chip right
that's an assistant and they've done
something that it's like we're singing
to do is you'd like desolder from the
system and you can read it right unless
they're doing sexy stuff like a
encrypting once ever on that well if
they're doing them where's the key
well it turns out a lot of the low-cost
systems don't actually have provisions
just to remove to use inside so
externally so find our key arts and read
it or use a logic analyzer and sniffing
key reading mechanism basically
everything has to well homomorphic
encryption aside everything eventually
has to be decrypted for use so sit
around listen that one which i
caramelize or to find out when you can
grab the firmware with excuse me in
plain text it's a part of question
[Music]
that's a tough question because so when
I was doing consulting like be presented
with a board and how to get something to
work on it and how can I don't do that
anymore and I just teach I go and grab
dozen boards and I picked the words very
easy
I've gotten really good at picking ones
that I know JTACs don't work on because
I want a good example of having a burger
so I would guess when it comes to like
Brenda a selection of like off-the-shelf
networking equipment right I would be I
can't I can't guess what I am finding is
more often devices and actually have
JTAG disabled it's how much it before
sometimes that means that in grammar on
it sometimes that means that got the
traces or traces on but even if they did
there's often ways to restore that
sometimes I actually use this to should
prevent JTAG so actually I was dealing
with a PLC and they have an XP LPC our
microcontroller on it and that's the
court of code we don't protection and
cheytac disabling didn't use it
so yeah whatever but if they had you
don't even go down the path of more
invasive are more attacks bleaching or
otherwise messing with the system to get
that back that device to give up its
code pretty good for lunch everything if
you just stop asking questions we can
even sooner
thank you very much for having me and I
am delighted to finally make it to a
secure airtight so please find me ask me
questions I also have a lot of stickers
with me today read the big half of the
Bloomberg article no super mario havend
it's pretty pricey sighs amen so what uh
yeah how much if I want to believe
sinners coming out see for those thank
you again