Hardware Podcasts

022 - Bits Through the Microscope

Unnamed Reverse Engineering Podcast · 30 Jun 2019 · 24m

What this episode covers

Chris Gerlinksy, a reverse engineering consultant from PDR North, explains how he extracts ROM data from microcontrollers by deprocessing chips and imaging them under a microscope. He details the evolution of security in PayTV smart cards, from simple 8-bit chips to modern devices with anti-tamper shields and implant ROMs that require specialized etching to reveal data. Gerlinksy also discusses the tools of the trade, including wet etching, CMP polishing, and micro-probing stations, as well as software for automating bit extraction from optical images.

Most relevant to

makers and hobbyists

Topics

Mentioned

Companies
PDR North
Products
Nintendo 64 CIC
Tools
IDA Pro, Ghidra
Also
SiliconPr0n

Related episodes from other shows

Other shows on the same ground, closest first.

  • The Amp Hour · 1h 21m

    An Interview with Dmitry Nedospasov

    Dmitry Nedospasov, a hardware security researcher and founder of the startup Toothless, discusses his work in IC security and reverse engineering. He details invasive and semi-invasive techniques for analyzing chips, including using focused ion beams and infrared cameras to extract secrets from smart cards and pay TV systems. Nedospasov also explains his training curriculum at the RECon conference, which teaches engineers how to use FPGAs for protocol analysis and hardware hacking.

    Debugging & failure analysisMicrocontrollers & dev platforms
    7 chapters

  • The Amp Hour · 21m

    #397.8 - An Interview with Chris Gerlinsky

    Chris Gerlinsky, an embedded reverse engineer based on Vancouver Island, explains his work decapping chips and microprobing to extract firmware and security keys from automotive ECUs and legacy cable set-top boxes. He details the physical processes of delayering ICs using chemicals and plasma etching to expose silicon bits, and discusses how aftermarket automotive companies use these techniques to integrate non-OEM parts into closed vehicle networks. Gerlinsky also contrasts the ease of reverse-engineering older pay-TV security chips with the increasing difficulty posed by modern automotive security measures like signed code and RSA signatures.

    Debugging & failure analysisSecurity & privacy
    8 chapters

  • Embedded.fm · 1h 00m

    352: Baby's First Hydrofluoric Acid

    John McMaster, president of McMaster Consulting, explains the process of decapping computer chips to extract firmware and analyze their internal structure. He details the use of hydrofluoric acid, lapping machines, and focused ion beam (FIB) tools to delayer chips, allowing for the imaging of ROM and other circuitry. McMaster also discusses software tools like Rompar and bitract for converting microscope images into binary code, and shares insights on the legal and technical aspects of reverse engineering older hardware like the SNES S-PPU1.

    PCB design & layoutDebugging & failure analysis
    12 chapters

  • Oxide and Friends · 1h 21m

    Another LPC55 ROM Vulnerability

    Laura Abbott, a security engineer at Oxide Computer Company, details the discovery of a second vulnerability in the NXP LPC55S69 microcontroller's ROM, which serves as Oxide's hardware root of trust. She explains how reverse engineering the undocumented ROM using Ghidra revealed a buffer overflow in the signed update parser that allowed extraction of device secrets before the system locked down. The episode covers the initial disclosure process, NXP's eventual receptiveness, and the broader industry challenges regarding transparency, CVEs, and the difficulty of securing general-purpose microcontrollers.

    Debugging & failure analysisSecurity & privacy
    13 chapters

  • Embedded.fm · 50m

    111: Potty Train Your Tamagotchi (Repeat)

    Natalie Silvanovich, a security engineer at Google Project Zero, discusses her reverse engineering of Tamagotchi devices, detailing how she dumped code from General Plus 6502-based hardware and created a development kit. She explains the technical challenges of working with mask ROM, undocumented processors, and the specific vulnerabilities in Tamagotchi 'figures' that allowed for code execution. Silvanovich also touches on her broader career in hardware and software security, including her work on Flash exploits and the 'Hardware Excuse Generator' tool.

    Debugging & failure analysisMicrocontrollers & dev platforms
    8 chapters

The summary, chapters and topics are generated from the episode’s audio by this directory, not written by Unnamed Reverse Engineering Podcast. The episode itself belongs to its publisher.