Close

Hack Chat Transcript, Part 1

A event log for Reverse Engineering Hack Chat

Glitching and JTAG and Ghidra, oh my!

Dan MaloneyDan Maloney 09/28/2022 at 20:040 Comments

Dan Maloney12:00 PM
Hello, everyone, welcome to the Hack Chat! I'm Dan, I'll be moderating today along with Dusan for Matthew Alt as we talk about reverse engineering in all its many forms!

@wrongbaud - Did I see you online already? I think I did...

Dusan Petrovic12:00 PM
Hi everyone!

FedX12:00 PM
\o

Dan Maloney12:00 PM
Hi Dule!

wrongbaud12:00 PM
Yup!

Dusan Petrovic12:00 PM
Hello Dan!

Ari12:00 PM
Hey Dan

Dan Maloney12:00 PM
Hey there, wlecome aboard!

Dan Maloney12:01 PM
Drat these fat fingers...

Dan Maloney12:01 PM
Anyway, welcome - I think most of us know a little about you, but maybe you can fill us in on your background a bit?

Nicolas Tremblay12:02 PM
@Dan Maloney Normally i plame autocorrect

Dan Maloney12:02 PM
"It's a poor craftsman what blames his tools," as AvE would say ;-)

wrongbaud12:03 PM
Sure! my name is Matt Alt (@wrongbaud) - I am a reverse engineer who focuses on embedded systems. My RE journey began at an ECU tuning shop in college where my job was to reverse engineer various automotive controllers. You can find some examples of my work on my personal blog: https://wrongbaud.github.io and my consulting blog: https://voidstarsec.com/blog

If you are interested in learning more about reverse engineering, check out our hackaday course that we put together here: https://hackaday.io/course/172292-introduction-to-reverse-engineering-with-ghidra

A few things before we kick off - I won't answer any questions regarding "hacking" facebook, instagram or other social media sites. I am happy to talk firmware extraction and analysis, low level interfaces, glitching, assembly languages and everything in between!

Dan Maloney12:04 PM
Excellent point -- we often get those requests here, sometimes mid-chat.

Dan Maloney12:06 PM
Funny you mention ECU hacking -- a friend recently had an emergency situation while driving where the car shut down because he needed to back up fast. He'd love a hack to prevent the anti-collision sensors from shutting the damn car off.

Dan Maloney12:07 PM
Not asking for specific help, mind you -- just thought it would be an interesting case to talk about.

wrongbaud12:07 PM
Definitely, I worked in the space from 2012-2016 and we mostly focused on engine controllers, our end goal was usually to reflash the engine controller with modified software for performance benefits.

wrongbaud12:08 PM
I imagine that we are going to see a lot of cool security research in the coming years with these "assistance" features, they seem like a good target

Przemek Klosowski12:08 PM
what do you think about the future of reverse engineering given the increasing role of security tech (secure boot, measured software, encrypted firmware etc). Is it same old same old or qualitative change?

wrongbaud12:10 PM
I think that there is always going to be low hanging fruit for people to learn with, but for more hardened targets I imagine we are going to see a lot more in the realm of fault injection techniques

.io12:10 PM
I assume when you hacked the ECU's you downloaded the code and found the fuel maps, tweaked them, and flashed it back? I doubt you were reinventing the wheel . . . no pun intended.

anfractuosity12:10 PM
wrt ECUs do you have to glitch the MCU, to be able to extract the firmware?

Mark J Hughes12:11 PM
How significant were the performance benefits vs the time spent engineering it?

wrongbaud12:11 PM
Correct, remapping, occasionally removing features that were considered detrimental for race times or instrumenting them further

wrongbaud12:12 PM
RE: Glitching ECUs, it depends on the specific MCU in use, sometimes yes, sometimes no

Mark J Hughes12:12 PM
How can I turn off the feature that shuts the damn car off everytime I'm at a red light?

Dan Maloney12:13 PM
@Mark J Hughes - I flippin' hate that! You're just a sitting duck if something happens!

wrongbaud12:13 PM
RE: Performance benefits, it would depend a lot on the car, for a turbocharged car sometimes we could squeeze anywhere between 25-50HP, for NA vehicles it was most about changing things like throttle response, etc to make the car drive more aggressively

wrongbaud12:14 PM
Here is a review of what the company is doing now: https://www.onlyrevo.com/blog/evo-magazine-revo-golf-r-stage-1-review/

Przemek Klosowski12:14 PM
On hybrids, it doesn't affect reaction time---electric drive is always-on, right? I got used to the ICU starting at random times.

Mark J Hughes12:15 PM
@Dan Maloney I know! There's a button I can press to shut it off -- but it resets every time. I know there's some CANbus command I can issue -- but then I have to plug in. And let's face it -- If I can't be bothered to press a little button, I'm not creating a custom CAN bus interface.

charliex12:15 PM
small world @wrongbaud

Przemek Klosowski12:15 PM
BTW, do you know if hybrids have 2 separate ECU or one for both engines?

wrongbaud12:16 PM
I don't, I'm not very familiar with hybrid vehicle ECUs

Mark J Hughes12:17 PM
@Przemek Klosowski

wrongbaud12:18 PM
@charliex do you currently work in the tuning industry? I've been out of it for some time now!

Dan Maloney12:20 PM
Don't want to get hung up on ECUs, but a question about logistics: If you're glitching an ECU, do you do it on the car? Or can you pull it out and glitch it on the bench?

charliex12:20 PM
@wrongbaud started doing RE work of ECU's in about 2005 for lotus/EFI, then did lambo/ferrari, tricores /bosch, genesis and so on, wrote tuning software, and a lot of dyno tuning work too ! :) i stopped doing it around 2011 since i just got burned out with it , but i know revo, did a lot of stuff via turboxs/jermaine if you know him. still do some occasionally to help out or interesting stuff but yeah not so much,

murrij12:21 PM
Hello. Any tips as far as how-tos, books, etc. on reverse engineering RF signals? I'd like to give my neighbor's weather station a shot. Those things are expensive to buy!

wrongbaud12:21 PM
Very cool! They are a great group of folks, I started with them when STASIS was still around - they had an office at a racetrack in West Virginia near my college

wrongbaud12:22 PM
@murrij I'm not extremely well versed in the space and have limited experience, but this lecture helped me a ton:

Dan Maloney12:22 PM
@murrij -- Funny, the next Hack Chat (Oct 12) will be about RF hacking!

charliex12:22 PM
yeah we did some work with them, always fun to work with talented folks. . anyway dont want to derail :)

charliex12:23 PM
are you liking ghidra over idapro ?i haven't really switched

murrij12:24 PM
@wrongbaud Thank you. Black Hills Security is good people. I hadn't seen that presentation.

@Dan Maloney Thank you. I'll be there for that Hack Chat.

wrongbaud12:24 PM
Definitely - there are some things that I prefer IDA for, but for flat memory maps, bespoke processors and scripting I really like Ghidra

wrongbaud12:25 PM
PCode emulation is extremely powerful as well, and since all processor modules are written in SLEIGH you can emulate _almost_ anything with a little elbow grease ;)

charliex12:25 PM
yeah i tried it a few times last year, but it was a little clunky, seems like its really coming along. just stuck on the devil you know. i might give it another try

wrongbaud12:26 PM
You should! Like anything I don't think there is a right or wrong answer I use a combination of both, but I prefer Ghidra for embedded stuff and IDA for windows stuff/c++

wrongbaud12:26 PM
I have a blog post here about PCode emulation where I use it to brute force all of the possible passwords for a Game Boy Advance game: https://wrongbaud.github.io/posts/kong-vs-ghidra/

charliex12:26 PM
yeah, i usually use the the lauterbach ice since its pretty much what oems use, but its also clunky. and he keeps playing around with the licensing :)

charliex12:27 PM
gba's are great, make awesome tuning tools too !

wrongbaud12:27 PM
Very nice! I have actually never used those tools before on any automotive targets, how much is the license for those tools if you don't mind me asking?

charliex12:30 PM
i always buy my lauterbach units off ebay and hteyre licensed to the hardware, you can use their sim/emulation software for free though if youre not doing hw ice . there is always some silicon valley company going out of business, and of course with any new startup they rush out and buy all the best gear.. some of the stuff we do is mil so they just pay for it, so we get nice bits thru them

charliex12:30 PM
trace32 etc

charliex12:31 PM
otoh they're about 12K

wrongbaud12:31 PM
I remembered looking at them once and having a customer laugh at the price tag, never thought to check ebay for them though, that is a good idea

Nathan Harvey joined  the room.12:32 PM

charliex12:32 PM
yeah there are loads on there too, just looked

charliex12:32 PM
but the software is free to download and run, so its only when you do the hardware ice obv, then it's ebay for all your RE needs

wrongbaud12:36 PM
For folks that are looking to get started in the RE space, OpenSecurityTraining is an excellent place to start:

https://p.ost2.fyi/

From there you can branch out to things like our Ghidra course we have here and other CTFs/wargames

wrongbaud12:37 PM
https://exploit.education/

https://microcorruption.com/

https://pwnable.kr/

Dan Maloney12:38 PM
FYI, I'll post a transcript right after the Chat in case you need to refer back to links, etc.

Mark J Hughes12:38 PM
Joe Grand teaches courses too.

Nathan Harvey12:38 PM
I used to think that if I was good enough at Reverse Engineering, I could take any device and use it for a different purpose, as long as it had the right peripherals. It seems it is way more complicated than that.

charliex12:40 PM
yeah i'm looking at the spotify car thing, they just arrived

Mark J Hughes12:40 PM
@Nathan Harvey And time consuming. You're missing time consuming

wrongbaud12:40 PM
There are a lot of great paid courses available, Joe Grand (http://www.grandideastudio.com/hardware-hacking-training/) , Joe Fitzpatrick (https://securinghardware.com) and myself (https://voidstarsec.com/training) are some examples for folks who want to learn more about hardware hacking and have a budget

wrongbaud12:41 PM
@Nathan Harvey I think it depends heavily on the device you're looking at

Mark J Hughes12:41 PM
@wrongbaud I hope you all charge a lot of money.

Mark J Hughes12:41 PM
You spent a lot of time and effort developing those skillsets.

charliex12:42 PM
colin o'flynn (newae) as well, if youre into hardware hackery, he just brought out a co authored book a few months ago too.

Mark J Hughes12:42 PM
What tools exist to help in reverse engineering today that weren't around 5 years ago?

wrongbaud12:44 PM
I think that the prices are all about the same, I'm launching a remote self directed version of mine next year and have 5 public remote offerings per year. It's cheaper than the standard conference training price.

REL Tools - Ghidra is a huge one, there have also been a lot of advances in fault injection tooling and resources via things like the ChipWhisperer that make that kind of work much more approachable

Nathan Harvey12:45 PM
@Mark J Hughes absoluely, I wasted so much time before, only to find out I had the wrong board entirely.

djl12:47 PM
I'd pay a lot to avoid bricking my car!

djl12:48 PM
Besides, every time I have the car serviced, the dealer "upgrades" the software.

Nathan Harvey12:49 PM
which would probably wipe out any changes

charliex12:49 PM
yeah, a lot of folks have the "do not flash" obd ii cover

Nathan Harvey12:49 PM
lol mine isn't covered at all

charliex12:49 PM
which of course the dealer tries to say means no warranty, but then you roll out magnusson moss act

charliex12:50 PM
best to buy ecu's off ebay to tinker with its an interest

djl12:50 PM
need a sensor emulation suite...

Nicolas Tremblay left  the room.12:52 PM

charliex12:52 PM
youd be surprised about little external hardware older ecus need to run, and they have a lot of little test devices that simulate the basics that are cheap and cheerful

wrongbaud12:54 PM
Depending on the ECU sometimes you just need +12V and a little CAN traffic to get them working

djl12:55 PM
start with a pinout?

charliex12:55 PM
yeah, find one thats well understood, subaru/fords etc

djl12:55 PM
I expose my total ignorance

charliex12:55 PM
also there is this, which is super fun https://github.com/ange-yaghi/engine-sim

charliex12:56 PM
entirely different, theres also the arduino ecu platorm that has sim inputs too, it'll teach you the basics of how engine tuning works

charliex12:57 PM
and like how not to tune til the engine detonates which makes me cringe every time i see a tuner do that on road/track or dyno.

djl12:58 PM
amazing. thanks, I'll stop with the noob basics...

charliex1:00 PM
@wrongbaud will check out ghidra again then, thanks for the recommend

Dan Maloney1:00 PM
It's about time to wrap up now, so I'll just say thanks to Matt for his time today and to everyone else too for the discussion. Thanks all!

wrongbaud1:00 PM
Hey Folks, I've got to run to another meeting but I'll be checking back here for any other questions that people have, feel free to DM me on here or reach out via twitter if anyonte has other questions https://twitter.com/wrongbaud

Dan Maloney1:01 PM
And like I said, transcript coming up.

charliex1:01 PM
thanks !!

wrongbaud1:01 PM
great timing!

Dan Maloney1:01 PM
Thanks Matt!

wrongbaud1:01 PM
Thanks folks, have a good rest of your day!

Dusan Petrovic1:01 PM
Thanks everyone!

charliex1:02 PM
@djl don't worry about starter questions, we all have to start somewhere and we were all new to something sometime, and still are.. ask away. thats the thing about RE work, it never stops being something new to learn

Discussions