BitBangingBytes's comments

On: PicoEMP – A low-cost Electromagnetic Fault Injection (EMFI) tool

[BitBangingBytes]

I used this to EMP pulse a locked processor to gain access and extract flash memory from it.

Gave a talk at hardwear.io this year on it. YouTube live stream here: https://youtube.com/live/0tkdst3JE0g

On: Zero Day in Microchip SAM Microcontrollers

[BitBangingBytes]

Have you published anything about this anywhere? I also had to work on the SLEIGH file for the M16C.

Overall it just seemed like the processor definition for Ghidra needed more work.

[dealbreaker → BitBangingBytes]

Particularly for this adventure, I have kept it strictly private. It was a hobby project and also was a challenge to myself.

In the process I learned not only of M32C(backwards compatible with M16C processor module in Ghidra), but as I mentioned, certain compiler bugs(not following the ISA spec strictly) that it is more flexible despite what the M16/M32C software manual says. However this meant that emulation produced wrong results, and thus my patches to fix it and ultimate success

I have opened a Ghidra support ticket, but I needed to provide proof that there is ISA behavior not described in the software manuals.

On: Zero Day in Microchip SAM Microcontrollers

[BitBangingBytes]

I don’t know if it was autocorrected or what, but it was SAM when I hit submit.

Edit: seems I could fix it, thanks!

On: Zero Day in Microchip SAM Microcontrollers

[BitBangingBytes]

The glitch has to happen within the window shown to you by the microcontroller. It seems to be in a different location for each microcontroller evaluated. The fact that it shows you where depending on which processor you’re attacking is pretty convenient!

[flowerthoughts → BitBangingBytes]

Amazing!

On: Zero Day in Microchip SAM Microcontrollers

[BitBangingBytes]

All decoupling caps were removed so the voltage fault injection could have maximum effect.

[boznz → BitBangingBytes]

Thanks, makes a lot more sense now, I guess if Vcc was lower the effect would be more pronounced if anything, never really considered this as an attack vector, but looking online now it seems to well established, I'm surprised Microchip engineers didn't pick it up.

[bobmcnamara → boznz]

Another good trick is to replace the crystal with a bit stream.

If you can identify the cycle where the security bits are being read you can insert a runt pulse that is much faster than the norflash read time.

On: Reverse Engineering News

[BitBangingBytes]

Starting a Reverse Engineering Weekly News Show, second week. All feedback is welcome!

On: Hacker reveals smart meters are spilling secrets about the Texas snowstorm

[BitBangingBytes]

There are two radio’s in the meter, one for zigbee and one for the 900MHz mesh that sends this data back to power company. The zigbee side isn’t used at all here anymore, they killed our ability to view our usage with it.