This document discusses hardware hacking techniques for reverse engineering devices on a budget. It introduces tools like logic analyzers, JTAG debuggers, and open source software that can be used to identify chip components, access device interfaces, extract file systems, and perform reverse engineering. Specific tips are provided for using tools like Saleae logic analyzers and OpenOCD to access UART, JTAG, and file systems on example router and chip components. The document aims to demonstrate affordable methods for hardware analysis and modification.

1. “Hack Mode” Enabled
Hardware Hacking on a Budget
BSides DFW 2016
Price McDonald

2. About:Me

3. O’Rly?

4. Ok, So Hardware Security sucks…
But why focus on the hardware?

5. Methodology

6. Where do we get theThings?
• Beta Programs
• https://www.betabound.com/tp-link-router-private-beta/
• https://beta.linksys.com/
• https://www.beta.netgear.com/signup/
• Flea Markets
• Ebay
• Craigslist
• Garage Sales

7. Disassembly “Voiding theWarranty”

8. Tamper Resistance/Detection/Alerting
They mean different things, but may not matter either way.

9. Component Identification
What do you see?

10. Component Identification(2)
• EOL 802.11G router SoC (System on Chip)
• 200 Mhz MIPS32 core
• Supports Serial or Parallel Flash
• One JTAG and two UART Ports
• 336 ball FBGA (Fine-pitch Ball Grid Array)
• 32M-BIT Parallel NOR Flash Memory
• 3V only
• 48-pinTSOP (Thin Small Outline Package)
• CMOS DDR400 RAM
• 66-pinTSOP II

11. Component IdentificationTip andTricks
The image part
with relationship
ID rId5 was not
found in the file.

12. Arts and CraftsTime

13. Finding Ground
• Using the MultiMeter we can figure out which of the pins on our
headers connect to ground and which have voltage.
GroundVoltage
Specifically 3.3v
• Got Ground?

14. Physical Counter Measures
Gap in trace
Extra Resistor

15. Common InterfaceTypes
• UART - Universal Asynchronous Receiver/Transmitter
• SPI – Serial Peripheral Interface
• I2C – Inter Integrated Circuit
• JTAG – JointTest Action Group – Hardware Debugging Interface
• CAN – Controller Area Network (Cars/ATM/etc)
• RS232- Serial Interface used on many legacy devices

16. Pinout Reversing
• Saleae Logic Analyzer
• ~100 Bucks on the low end @ https://www.saleae.com
• Also, EDU discounts available up to 50% depending on model.
• Keep in mind that logic analyzers are sampling which can cause
artificial data depending on the sampling rate and thresholds.
• Works for I2C, UART, SPI, JTAG, CAN, etc, etc

17. Saleae Logic UI
• Using the Saleae logic analyzer we can watch the pins during boot to check for voltage spikes
during. This is a good indication of either a UART, I2C or SPI connection.
System Boot Likely the boot log being
transmitted over UART

18. Saleae Logic - Decoders
Given that we suspect Async Serial
(UART) we will select that analyzer

19. Saleae Logic - Decoding
Among small embedded devices 115200 is a very common bit rate so it is an easy guess. But
we will also cover a more automated way of determining bit rate.

20. Saleae Logic – Decoding(2)
We must also ensure we are configuring the device to analyze the appropriate channel
(which are color coded as long as you connect them correctly)

21. Saleae Logic – Output
As you can see we are successfully decoding the output from the UART serial connection
on our Broadcom chip.

22. Or, Have you heard of the Jtagulator?
• Created by Joe Grand @ http://www.grandideastudio.com
• ~180-200 Bucks

23. Connecting to Interfaces
• Bus Pirate
• Less of a learning curve
• Slower transfer speeds
• Supports UART, SPI, I2C and JTAG
• Shikra
• No UI but faster transfer speeds as a result
• Supports UART, SPI, I2C and JTAG
• TIAO USB Multiprotocol Adapter
• No UI but faster transfer speeds as a result
• Supports UART, SPI, I2C, JTAG, RS-232
• Supports multiple connections from same device
• Slightly less reliable in my experience

24. Using the Shikra
http://int3.cc/products/the-shikra

25. Connecting to UART
The command used to connect to a UART serial adapter will vary by device and OS
but will generally be similar to the command below.
sudo screen /dev/[device id] baud rate
Or the the case of the Device ID below for the Shikra:
sudo screen /dev/ttyUSB0 115200

26. We now have shell!
hopefully
But now what?

27. NoTech hacking

28. NoTech hacking(2)

29. File System Fiddling
Why is my root a mtdblock?
But wait, what is an mtdblock?
• MTD is a "MemoryTechnology Device.
• Unix traditionally only knew block devices and character devices. Character devices were
things like keyboards or mice, that you could read current data from, but couldn't be seek-ed
and didn't have a size. Block devices had a fixed size and could be seek-ed.
• A mtdblock is a block device emulated over an mtd device.
Source:Wikipedia

30. File System Fiddling(2)
Often times embedded device manufacturers leave important file systems unmounted.
Another good Resource:
http://wiki.in-circuit.de/index.php5?title=Flashfilesystem_UBIFS

31. Pilfering File Systems
But, How do we get the file system off of the target device?

32. SSHWhoops?

33. Ultra quick JTAG primer
• JTAG stands for (JointTest Action Group) which was formed in 1985.
• IDCODE , BYPASS Registers are often very helpful
• The following pins are required for JTAG use:
• TDI (Test Data In)
• TDO (Test Data Out)
• TCK (Test Clock)
• TMS (Test Mode Select)
• TheTCK Pin (Test Clock) is what keeps the clock for the state machine.
• THETMS Pin (Test Mode Select) is what determines when and how the State Machine advances depending on it’s relative
position during each clock cycle.
Source:
Wikipedia

34. Options for connecting to JTAG
Good Better Best
$45 $60-$600 $5000-$20000

35. Jtagulator

36. How to Connect with OpenOCD
The command to initiate openocd is : openocd –f interface –f target
But now what? There are errors and stuff!!!!!
#openocd on Freenode

37. How to Connect with OpenOCD(2)
Silly openocd!
That’s more like it J

38. Using OpenOCD

39. Reverse Engineering
• Ida Pro
• PaidVersion required for disassembly
• ARM decompiler available but $$$$
• Also very good debugger
• Radare2
• Free multiplatform support
• No decompiler available
• Binary Ninja
• Free version available
• Very Limited Architecture Support
• Not currently an option for this type of
work but something to keep in mind.

40. IDA Pro

41. Radare2

42. Other nice to haves

43. • http://www.grandideastudio.com/hardware-hacking-training/
• http://www.xipiter.com/training.html
• https://www.eevblog.com
• http://www.embedded.com/electronics-blogs/beginner-s-corner/

44. THANKYOU!!!!
ANY MORE QUESTIONS?