Hardware Podcasts

054 - It's A Calibration, Not An Update!

Unnamed Reverse Engineering Podcast · 11 Feb 2022 · 1h 16m · Episode 54

What this episode covers

Willem Melching, head of OpenPilot at comma.ai, details his journey from hobbyist electronics to reverse engineering automotive ECUs. He explains how he bypassed security on a VW Golf power steering module by exploiting a calibration protocol to dump firmware, then used Ghidra and binwalk to modify safety limits. Melching also describes the architecture of OpenPilot, an open-source Level 2 driver assistance system that supports over 150 cars by reverse engineering their CAN bus communications.

Most relevant to

early-stage companies

Topics

Mentioned

Companies
comma.ai
Products
OpenPilot, Audi Q8, VW Golf, Panda, Open DBC
Chips
V850
Tools
Ghidra, binwalk, GLScopeClient

Related episodes from other shows

Other shows on the same ground, closest first.

  • The Amp Hour · 21m

    #397.8 - An Interview with Chris Gerlinsky

    Chris Gerlinsky, an embedded reverse engineer based on Vancouver Island, explains his work decapping chips and microprobing to extract firmware and security keys from automotive ECUs and legacy cable set-top boxes. He details the physical processes of delayering ICs using chemicals and plasma etching to expose silicon bits, and discusses how aftermarket automotive companies use these techniques to integrate non-OEM parts into closed vehicle networks. Gerlinsky also contrasts the ease of reverse-engineering older pay-TV security chips with the increasing difficulty posed by modern automotive security measures like signed code and RSA signatures.

    Debugging & failure analysisSecurity & privacy
    8 chapters

  • Embedded.fm · 1h 05m

    149: Flamethrowers Aside

    Craig Smith, author of the Car Hackers Handbook and founder of OpenGarages, discusses the technical and cultural aspects of automotive security and modification. He explains how CAN bus networks function, why they lack inherent security, and how attackers can exploit vulnerabilities in infotainment systems to gain code execution. Smith advocates for open access to vehicle data, the use of junkyard parts for safe testing, and the importance of organizations like I Am The Cavalry in bridging the gap between security researchers and traditional automakers.

    Security & privacyEmbedded firmware
    10 chapters

  • The Amp Hour · 1h 21m

    An Interview with Earl Sharpe and Collin Kidder

    Earl Sharpe and Collin Kidder of Macchina discuss automotive electronics, car hacking, and the architecture of modern vehicles. They explain how the OBD2 port provides access to CAN bus data, the challenges of reverse engineering proprietary protocols, and the security implications of drive-by-wire systems. The conversation covers the Macchina M2 development platform, the Savvy Can software tool, and the business dynamics of OEMs restricting aftermarket access to vehicle components.

    Embedded firmwareMicrocontrollers & dev platforms
    7 chapters

  • Embedded.fm · 58m

    415: Rolling Computers

    Benny Meisels, Lead Solution Architect at Cymotive, discusses the evolving security landscape of modern vehicles, which he describes as 'rolling computers.' He explains how the shift from isolated ECUs to connected systems with over-the-air updates creates new attack surfaces, particularly regarding keyless entry vulnerabilities like relay attacks and UWB distance reduction. Meisels emphasizes the need for end-to-end threat modeling across the complex supply chain of Tier 1, 2, and 3 suppliers, and highlights tools like ASRG, ICSim, and Car in a Box for learning automotive security.

    Security & privacyEmbedded firmware
    10 chapters

  • Embedded.fm · 1h 12m

    259: Calculators Changed My Life

    Brandon Wilson, a software developer and security consultant, discusses his decades-long journey of hacking Texas Instruments graphing calculators, starting from middle school. He details the technical evolution of TI's security measures, including the use of Z80 and Motorola 68K processors, flash unlock exploits, and the eventual factorization of 512-bit RSA signing keys by the community. Wilson also describes his reverse engineering of a limited-edition Sega Genesis game cartridge and his work on abusing USB protocols to jailbreak the PlayStation 3 and modify cheap USB flash drive firmware.

    Debugging & failure analysisMicrocontrollers & dev platforms
    7 chapters

The summary, chapters and topics are generated from the episode’s audio by this directory, not written by Unnamed Reverse Engineering Podcast. The episode itself belongs to its publisher.