Reverse Engineering Smart Meters
summary
Reverse engineers a deployed AMI that uses 902–928 MHz FSK with frequency hopping across 240 channels at ~100 kHz spacing and ~9,600 baud, captures packets with USRP B200 and HackRF, and uses GNU Radio plus Sandia’s FHSS toolkit to demodulate and tag bursts in real time. Extracts firmware via FPGA glitching from meters using a CC1020 transceiver, recovers CRC-16 (poly 0x1021, init 0x5FD6) to validate packets, decodes meter IDs, uptime and embedded GPS, and builds a working collector/mini-network from a Windows-based collector image; receiver code is on GitHub.
AI-written summary · about
chapters (8)
- 0:00Smart meter reverse engineering
- 3:51Smart meter networks
- 7:22Smart meter hardware
- 11:58Capturing meter wireless data
- 18:00Decoding GPS and uptime
- 22:38Personal smart meter network
- 25:46Collector software reverse engineering
- 28:13Conclusion
related talks
01h 02mHacking the Wireless World with Software Defined Radio - 2.0
53mHacking the Wireless World with Software Defined Radio - 2.0
01h 00mHacking the Wireless World with Software Defined Radio - 2.0
56mLights Off! The Darkness of the Smart Meters
01h 01mRapid Radio Reversing
49mOpen Source Tools of the Hardware Hacking Trade
51mRadio Hacking: Cars, Hardware, and more!
51mReverse Engineering of Proprietary Radio Protocols