DVB-T Hacking
summary
Research extracts the MSTAR-based DVB-T receiver firmware by dumping the 64Mbit SPI flash with an Arduino and serial FTDI console, reverses a MIPS COS RTOS image, and builds an ad-hoc debugger by patching the M-Boot exception vector to implement break/read/write/register primitives. Fuzzing the DVB-T time offset table reveals a stack overflow in descriptor parsing (assumes 15-byte entries despite up to ~4,000 possible), and an exploit is delivered over‑the‑air via HackRF/USRP, enabling code execution because cache and DEP are disabled; firmware dumped via SPI with Arduino and debugger injected by patching M-Boot exception vector.
AI-written summary · about
chapters (12)
- 0:00Start
- 3:27Obtaining the firmware
- 6:10SHELL ACCESS
- 8:42SPI - Serial Peripheral Interface
- 9:46Reversing notes
- 11:27SERIAL CONNECTION
- 13:36Writing the debugger - The breakpoint
- 14:36MIPS exception vector
- 15:40Debugger primitives
- 16:01Debugger design & requirements
- 16:58Loading the debugger into memory
- 25:55Exploiting it
related talks
40mOver the Air, Under the Radar: Attacking and Securing the Pixel Modem
44mExposing Critical Threats In Millions Of Connected Devices
41mUnlock hidden Superpowers in MediaTek Wi-Fi Chips
49mAll the 4G Modules Could be Hacked
01h 46mTutorial: Introduction to Reverse Engineering
30mCommSec D1 - How to Find and Exploit Bugs in IoT Devices
40mYour Mediatek Wi Fi Chip's Secrets Bypassing Firmware Encryption
48mFatal Fury on ESP32: Time to Release Hardware Exploits