# 043 - Filling In  Zeros

- Show: [Unnamed Reverse Engineering Podcast](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast)
- Published: 2020-12-21
- Length: 1h 15m
- Page: https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2020-12-21-043-filling-in-zeros
- Listen: https://unnamedre.com/episode/43

## Summary

Dmitry Grinberg, a hardware hacker and repeat guest, details his reverse engineering of the Nintendo Pokéwalker, which uses a Renesas H8 microcontroller. He explains how he bypassed the chip's self-erase protection by exploiting a buffer overflow in its decompression algorithm to dump the ROM and execute arbitrary code. The discussion also covers his analysis of various processor architectures, specifically contrasting the compiler-friendly H8 and ARM designs with the notoriously difficult 8051 and PIC architectures.

## Chapters

- [0:30](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2020-12-21-043-filling-in-zeros#t=30) Introduction: Dmitry Grinberg and the Pokéwalker Project
- [1:45](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2020-12-21-043-filling-in-zeros#t=105) Pokéwalker History and Hardware Specifications
- [8:00](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2020-12-21-043-filling-in-zeros#t=480) Reverse Engineering the Renesas H8 Microcontroller
- [15:52](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2020-12-21-043-filling-in-zeros#t=952) Exploiting the Decompression Buffer Overflow
- [25:32](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2020-12-21-043-filling-in-zeros#t=1532) Disassembly, Payload Crafting, and ROM Dumping
- [45:10](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2020-12-21-043-filling-in-zeros#t=2710) Critique of 8051 and PIC Architectures
- [51:44](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2020-12-21-043-filling-in-zeros#t=3104) Modern CPU Design for C Compilers
- [58:14](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2020-12-21-043-filling-in-zeros#t=3494) Current Projects: Pocket Station, E-ink Tags, and FPGAs

## Topics

- [Debugging & failure analysis](https://hardwarepodcasts.com/topic/debugging-and-failure-analysis)
- [Microcontrollers & dev platforms](https://hardwarepodcasts.com/topic/microcontrollers-and-platforms)
- [Embedded firmware](https://hardwarepodcasts.com/topic/embedded-firmware)
- [Sensors & measurement in products](https://hardwarepodcasts.com/topic/sensors)
- [Chips, FPGAs & semiconductors](https://hardwarepodcasts.com/topic/chips-and-fpgas)

## Most relevant to

makers and hobbyists

## Mentioned

- Pokéwalker (product)
- Renesas (company)
- H8300 (chip)
- IDAPRO (tool)
- Sparkfun Prototype HARP (product)
- Pocket Station (product)
- 8051 (chip)
- PIC (chip)
- iCE40 (chip)

## Related episodes from other shows

- [414: Puff, the Magically Secure Dragon](https://hardwarepodcasts.com/podcast/embedded-fm/2022-05-26-414-puff-the-magically-secure-dragon) (Embedded.fm)
- [Another LPC55 ROM Vulnerability](https://hardwarepodcasts.com/podcast/oxide-and-friends/2022-04-05-another-lpc55-rom-vulnerability) (Oxide and Friends)
- [111: Potty Train Your Tamagotchi (Repeat)](https://hardwarepodcasts.com/podcast/embedded-fm/2017-07-19-111-potty-train-your-tamagotchi-repeat) (Embedded.fm)
- [259: Calculators Changed My Life](https://hardwarepodcasts.com/podcast/embedded-fm/2018-09-07-259-calculators-changed-my-life) (Embedded.fm)
- [Ep 284: Laser Fault Injection, Console Hacks, and Too Much Audio](https://hardwarepodcasts.com/podcast/hackaday-podcast/2024-08-16-ep-284-laser-fault-injection-console-hacks-and-too-much-audio) (Hackaday Podcast)

## Citing this page

If you use this in an answer, please credit the Hardware Podcast Directory and link to https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2020-12-21-043-filling-in-zeros. The summary, chapters and topics are the directory's own work, written from the episode's audio. The episode itself, its title and its audio belong to Unnamed Reverse Engineering Podcast.