Don’t Trash It, Hack It: Reverse Engineering Secrets & Re-purposing ISP Routers
Talkat Open Source Summit India 2026 · on Wednesday, 2026-06-17· at 12:50· Lotus Ballroom 2 (Level 3)·
summary
Shows how a commercial ISP router is fully reclaimed: firmware is dumped via UART or SPI (CH341), U‑Boot is intercepted because of no U‑Boot timeout, the boot env is edited to add bin sh and land a root shell, a readable 8MB UBI writable partition hosts custom binaries, a hardcoded password in the CLI binary is found via objdump/GDB and decompiled with Ghidra, a Ghidra patch flips the auth check and the patched binary is reflashed, then the device runs OpenWrt builds, tailscale, a storage server and a dnsmasq ad‑blocker.
AI-written summary · about
chapters (24)
- 0:00Introduction
- 1:05Accessing router via UART and Uboot
- 3:11Bypassing Uboot timeout
- 5:40Read-only vs read-write partitions
- 6:22Extracting passwords from CLI
- 7:46MIPS assembly basics
- 8:50Position Independent Code in MIPS
- 10:17Decoding MIPS instructions
- 11:41Analyzing MIPS function prologues
- 13:05Calculating GOT addresses
- 14:32Reverse engineering password storage
- 17:27Setting up GDB server
- 19:35Debugging auth binary
- 23:49Hex editors and GRA
- 27:02Patching instructions to bypass auth
- 28:50Creating backdoors on router
- 29:35Porting OpenWRT to RTL9607
- 30:17Q&A Uboot security
- 33:53Q&A GRA labeling
- 34:17Q&A secure boot attacks
- 35:23Q&A learning assembly
- 37:29Q&A networking to security
- 39:12Q&A embedded Linux
- 40:16Summary
related talks
30mCommSec D1 - How to Find and Exploit Bugs in IoT Devices
40mIntroduction to IoT Reverse Engineering
25mAdventures & Findings in ISP Hacking
01h 46mTutorial: Introduction to Reverse Engineering
39mWho put the backdoor in my modem?
28mThe IoT Hacker's Toolkit
41mModding Security & Privacy
30mNetwork Technocracy: A Tale of Monitoring, Spoofing, Intercepting and Social Engineering