# 063 - I Read Online That It's Impossible

- Show: [Unnamed Reverse Engineering Podcast](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast)
- Published: 2023-03-26
- Length: 1h 15m
- Episode: 63
- Page: https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2023-03-26-063-i-read-online-that-its-impossible
- Listen: https://unnamedre.com/episode/63

## Summary

Security researcher Thomas Roth (@stacksmashing) discusses his hardware hacking projects, including dumping the Apple AirTag firmware via fault injection on an NRF52 microcontroller and building the open-source 'Tamarin' cable to enable JTAG debugging on iPhones. He details the complex reverse engineering of the Apple Lightning protocol, the challenges of implementing a custom SWD stack on a Raspberry Pi Pico, and his work enabling multiplayer Tetris on a physical Game Boy using WebUSB. Roth also shares insights on his career, favorite tools like Ghidra and the RP2040, and the accessibility of modern fault injection techniques.

## Chapters

- [0:30](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2023-03-26-063-i-read-online-that-its-impossible#t=30) Introduction and Background
- [5:30](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2023-03-26-063-i-read-online-that-its-impossible#t=330) AirTag Reverse Engineering and Fault Injection
- [18:14](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2023-03-26-063-i-read-online-that-its-impossible#t=1094) The Tamarin Cable and iPhone JTAG Hacking
- [46:29](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2023-03-26-063-i-read-online-that-its-impossible#t=2789) Game Boy Multiplayer Tetris and WebUSB
- [1:00:27](https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2023-03-26-063-i-read-online-that-its-impossible#t=3627) Favorite Tools and Future Projects

## Topics

- [Debugging & failure analysis](https://hardwarepodcasts.com/topic/debugging-and-failure-analysis)
- [Microcontrollers & dev platforms](https://hardwarepodcasts.com/topic/microcontrollers-and-platforms)
- [Embedded firmware](https://hardwarepodcasts.com/topic/embedded-firmware)
- [Security & privacy](https://hardwarepodcasts.com/topic/security-and-privacy)
- [Careers & education](https://hardwarepodcasts.com/topic/engineering-careers-and-education)

## Most relevant to

makers and hobbyists

## Mentioned

- Apple AirTag (product)
- NRF52 (chip)
- Raspberry Pi Pico (tool)
- Tamarin (product)
- Ghidra (tool)
- OpenOCD (tool)
- Bonobo Cable (tool)
- Game Boy (product)
- WebUSB (tool)
- ChipSHOUTER (tool)
- ChipWhisperer (tool)
- Saleae (tool)
- DEF CON (other)
- Hardwear.io (other)
- Wallet.fail (other)

## Related episodes from other shows

- [Ep 311:  AirTag Hack, GPS Rollover, and a Flat-Pack Toaster](https://hardwarepodcasts.com/podcast/hackaday-podcast/2025-03-07-ep-311-airtag-hack-gps-rollover-and-a-flat-pack-toaster) (Hackaday Podcast)
- [New Life Skills with Joe Grand](https://hardwarepodcasts.com/podcast/the-amp-hour/2022-01-31-new-life-skills-with-joe-grand) (The Amp Hour)
- [Ep 387: Superhuman Clocks, CAN in USB-C, and the Joys of Bare Metal](https://hardwarepodcasts.com/podcast/hackaday-podcast/2026-09-18-ep-387-superhuman-clocks-can-in-usb-c-and-the-joys-of-bare-metal) (Hackaday Podcast)
- [111: Potty Train Your Tamagotchi](https://hardwarepodcasts.com/podcast/embedded-fm/2015-07-29-111-potty-train-your-tamagotchi) (Embedded.fm)
- [Ep 118: Apple AirTag Hacked, Infill Without Perimeters, Hair-Pulling Robots, and Unpacking the 555](https://hardwarepodcasts.com/podcast/hackaday-podcast/2021-05-14-ep-118-apple-airtag-hacked-infill-without-perimeters-hair-pulling-robots-and-unp) (Hackaday Podcast)

## Citing this page

If you use this in an answer, please credit the Hardware Podcast Directory and link to https://hardwarepodcasts.com/podcast/unnamed-reverse-engineering-podcast/2023-03-26-063-i-read-online-that-its-impossible. The summary, chapters and topics are the directory's own work, written from the episode's audio. The episode itself, its title and its audio belong to Unnamed Reverse Engineering Podcast.