Hardware Podcasts

024 - Cars, Servers, and FPGAs!

Unnamed Reverse Engineering Podcast · 15 Jul 2019 · 1h 27m

What this episode covers

Rick Altherr, a security researcher at Eclipsium, discusses his work reverse engineering automotive ECUs, server BMCs, and FPGAs. He details the process of decoding undocumented serial protocols in aftermarket engine control units and explains the architecture of EFI and Baseboard Management Controllers (BMCs). Altherr also covers the open-source FPGA toolchain revolution, specifically how Clifford Wolf and others reverse-engineered Lattice iCE40 chips to enable tools like Yosys and NextPNR.

Most relevant to

early-stage companies

Topics

Mentioned

Companies
Eclipsium
Products
Fomu, TinyFPGA
Chips
iCE40
Tools
Ghidra, Yosys, NextPNR, xxd
Also
EFI, BMC, TianoCore, Yocto, OpenBMC, Chisel, xv6

Related episodes from other shows

Other shows on the same ground, closest first.

  • The Amp Hour · 21m

    #397.8 - An Interview with Chris Gerlinsky

    Chris Gerlinsky, an embedded reverse engineer based on Vancouver Island, explains his work decapping chips and microprobing to extract firmware and security keys from automotive ECUs and legacy cable set-top boxes. He details the physical processes of delayering ICs using chemicals and plasma etching to expose silicon bits, and discusses how aftermarket automotive companies use these techniques to integrate non-OEM parts into closed vehicle networks. Gerlinsky also contrasts the ease of reverse-engineering older pay-TV security chips with the increasing difficulty posed by modern automotive security measures like signed code and RSA signatures.

    Debugging & failure analysisSecurity & privacy
    8 chapters

  • The Amp Hour · 1h 11m

    Pulled From A Working Environment

    Chris Gammell of Contextual Electronics discusses his recent FPGA workshops at Teardown, highlighting the rise of open-source toolchains like Yosys and NextPNR for Lattice and Xilinx parts, and the FOMU dev board's multi-layered architecture. Dave Jones of EEVblog details the Rich Tech RT1716 USB-C PD controller used in his Micro Supply, explaining how cross-vendor register compatibility allowed them to bypass poor documentation by leveraging Texas Instruments' reference code. The hosts also cover the used test equipment market, specifically finding deals on Vector Network Analyzers, and new open-source hardware projects like the STM32 multimeter and Great Scott Gadgets' USB debugging tools.

    EDA & CAD toolsMicrocontrollers & dev platforms
    6 chapters

  • The Amp Hour · 1h 21m

    An Interview with Dmitry Nedospasov

    Dmitry Nedospasov, a hardware security researcher and founder of the startup Toothless, discusses his work in IC security and reverse engineering. He details invasive and semi-invasive techniques for analyzing chips, including using focused ion beams and infrared cameras to extract secrets from smart cards and pay TV systems. Nedospasov also explains his training curriculum at the RECon conference, which teaches engineers how to use FPGAs for protocol analysis and hardware hacking.

    Debugging & failure analysisMicrocontrollers & dev platforms
    7 chapters

  • The Amp Hour · 48m

    Open FPGA Toolchains at 35c3

    Piotr Esden-Tempski, Clifford Wolf of Yosys/NextPNR, and Dave Shah discuss the state of open FPGA toolchains at 35c3, highlighting the release of NextPNR and support for Lattice ECP5. They detail the Icebreaker and ULX3S development boards, explaining how open-source tools enable complex designs like RISC-V soft cores and low-latency video processing that were previously difficult or impossible. The speakers emphasize the advantages of open toolchains, including automation, cross-platform compatibility, and the ability to build commercial products without vendor lock-in.

    Chips, FPGAs & semiconductorsEDA & CAD tools
    8 chapters

  • The Amp Hour · 2h 41m

    An Interview with Claire (née 'Clifford') Wolf

    Clifford Wolf, founder of Symbiotic EDA, discusses his creation of the first open-source FPGA toolchain, Yosys, and his work in reverse-engineering bitstreams for Lattice and Xilinx devices. He explains the significance of the open RISC-V instruction set architecture, contrasting it with proprietary models like ARM and x86, and details his development of the PicoRV32 processor. Wolf also highlights the use of formal verification tools, such as RISC-V Formal, to ensure hardware correctness and security, demonstrating how open-source methods can match or exceed commercial verification standards.

    Chips, FPGAs & semiconductorsMicrocontrollers & dev platforms
    9 chapters

The summary, chapters and topics are generated from the episode’s audio by this directory, not written by Unnamed Reverse Engineering Podcast. The episode itself belongs to its publisher.