Breaking Bootloaders on the Cheap
summary
Reverse‑engineers target NXP LPC1343, ST STM32F4 and ST STM8 bootloaders and find a LPC1343 vulnerability: the bootloader’s Write to RAM command lacks stack/address checks, letting an attacker overwrite return addresses and use return‑oriented programming to read protected ROM (CRP1) by pointing the read function at the CRP word (0x2FC). Exploit runs over a $5 UART cable, needs no glitching, successfully dumps ROM; NXP updates guidance to prefer CRP2/3.
AI-written summary · about
chapters (12)
- 0:00Introduction to speaker
- 1:02Embedded security overview
- 2:36Analyzing device targets
- 3:46Bootloader analysis methods
- 5:46STM8 and STM32 security
- 8:12LPC1343 device vulnerability
- 10:12LPC1343 memory layout
- 13:24Exploitation strategies
- 17:13Return-oriented programming
- 19:27Executing the attack
- 21:42Live demonstration
- 22:18Conclusion and disclosure
related talks
39mBackdooring Hardware Devices by Injecting Malicious Payloads on Microcontrollers
01h 07mPEW PEW PEW: Designing Secure Boot Securely
25mBootStomp: On the Security of Bootloaders in Mobile Devices
21mBreaking Espressif’s ESP32 V3: Program Counter Control with Computed Values using...
29mBackdooring of Real Time Automotive OS Devices
01h 46mTutorial: Introduction to Reverse Engineering
49mBreaking Through Another Side: Bypassing Firmware Security Boundaries from Embedded Controller
48mReverse-Engineering the Supra iBox: Exploitation of a Hardened MSP430-Based Device