Breaking Into Chips By Reading The Datasheet
summary
Reverse-engineers extract firmware from a 40‑year‑old Renesas 78K0‑series micro by abusing documented flash commands and on‑chip verification logic instead of a read command. They use a Teensy bitbanger, logic analyzer and scope with a current shunt and find power analysis gives ~4 bits/byte so they implement a write‑verify brute force that writes guessed bytes until the chip ACKs, then step backwards to recover blocks. They code a Python disassembler and recover roughly 4,000 bytes of firmware successfully.
AI-written summary · about
chapters (8)
- 0:00Introduction and discovery
- 1:01Initial research and roadblocks
- 3:52Analyzing the datasheet
- 8:06Developing a novel attack
- 14:42First attempt and failure
- 18:24Refined memory dumping attack
- 22:34Disassembly and analysis
- 25:51Demonstration and discussion
related talks
01h 46mTutorial: Introduction to Reverse Engineering
45mReverse Engineering Flash Memory for Fun and Benefit
01h 03mHack To Discover Weaknesses In A Series Of Smartcards
49mBreaking Through Another Side: Bypassing Firmware Security Boundaries from Embedded Controller
27mReverse Engineering Custom ASICs By Exploiting Supply-Chain Leaks
48mReverse-Engineering the Supra iBox: Exploitation of a Hardened MSP430-Based Device
48mFatal Fury on ESP32: Time to Release Hardware Exploits
21mOpen Source IC Design and Hardware Reverse Engineering Or: How I Learned to Stop...