Hardware Podcasts

043 - Filling In Zeros

Unnamed Reverse Engineering Podcast · 21 Dec 2020 · 1h 15m

What this episode covers

Dmitry Grinberg, a hardware hacker and repeat guest, details his reverse engineering of the Nintendo Pokéwalker, which uses a Renesas H8 microcontroller. He explains how he bypassed the chip's self-erase protection by exploiting a buffer overflow in its decompression algorithm to dump the ROM and execute arbitrary code. The discussion also covers his analysis of various processor architectures, specifically contrasting the compiler-friendly H8 and ARM designs with the notoriously difficult 8051 and PIC architectures.

Most relevant to

makers and hobbyists

Topics

Mentioned

Companies
Renesas
Products
Pokéwalker, Sparkfun Prototype HARP, Pocket Station
Chips
H8300, 8051, PIC, iCE40
Tools
IDAPRO

Related episodes from other shows

Other shows on the same ground, closest first.

  • Embedded.fm · 58m

    414: Puff, the Magically Secure Dragon

    Laura Abbott, a firmware engineer at Oxide Computing, discusses two silicon bugs found in the NXP LPC55S69 microcontroller, including a buffer overflow in the ROM that allows cloning the device's PUF identity. She explains how she used Ghidra to reverse-engineer the undocumented ROM code and details the security implications for TrustZone and Secure Boot. The conversation also covers Oxide's approach to hiring, their use of Rust for firmware, and the challenges of working with proprietary silicon.

    Debugging & failure analysisMicrocontrollers & dev platforms
    7 chapters

  • Oxide and Friends · 1h 21m

    Another LPC55 ROM Vulnerability

    Laura Abbott, a security engineer at Oxide Computer Company, details the discovery of a second vulnerability in the NXP LPC55S69 microcontroller's ROM, which serves as Oxide's hardware root of trust. She explains how reverse engineering the undocumented ROM using Ghidra revealed a buffer overflow in the signed update parser that allowed extraction of device secrets before the system locked down. The episode covers the initial disclosure process, NXP's eventual receptiveness, and the broader industry challenges regarding transparency, CVEs, and the difficulty of securing general-purpose microcontrollers.

    Debugging & failure analysisSecurity & privacy
    13 chapters

  • Embedded.fm · 50m

    111: Potty Train Your Tamagotchi (Repeat)

    Natalie Silvanovich, a security engineer at Google Project Zero, discusses her reverse engineering of Tamagotchi devices, detailing how she dumped code from General Plus 6502-based hardware and created a development kit. She explains the technical challenges of working with mask ROM, undocumented processors, and the specific vulnerabilities in Tamagotchi 'figures' that allowed for code execution. Silvanovich also touches on her broader career in hardware and software security, including her work on Flash exploits and the 'Hardware Excuse Generator' tool.

    Debugging & failure analysisMicrocontrollers & dev platforms
    8 chapters

  • Embedded.fm · 1h 12m

    259: Calculators Changed My Life

    Brandon Wilson, a software developer and security consultant, discusses his decades-long journey of hacking Texas Instruments graphing calculators, starting from middle school. He details the technical evolution of TI's security measures, including the use of Z80 and Motorola 68K processors, flash unlock exploits, and the eventual factorization of 512-bit RSA signing keys by the community. Wilson also describes his reverse engineering of a limited-edition Sega Genesis game cartridge and his work on abusing USB protocols to jailbreak the PlayStation 3 and modify cheap USB flash drive firmware.

    Debugging & failure analysisMicrocontrollers & dev platforms
    7 chapters

  • Hackaday Podcast · 59m

    Ep 284: Laser Fault Injection, Console Hacks, and Too Much Audio

    Hosts Elliot Williams and Dan Maloney discuss a variety of hardware hacks, including a buffer overflow exploit in Tony Hawk's Pro Skater that allows jailbreaking consoles and executing code on PCs, and a low-cost DIY laser fault injection rig by Fractal that uses a galvanometer to scan chips for vulnerabilities. They also cover Tulip, a MicroPython synthesizer workstation on an ESP32 S3, and Jeremy Fielding’s explanation of Mecanum wheels for omnidirectional robotics. The episode concludes with deep dives into getting audio from a Raspberry Pi and building a portable router using an Onion Omega 2 Plus.

    Security & privacyMicrocontrollers & dev platforms
    7 chapters

The summary, chapters and topics are generated from the episode’s audio by this directory, not written by Unnamed Reverse Engineering Podcast. The episode itself belongs to its publisher.