✧✦Catherine✦✧Jun 11
girl who flirts with you by sending you drone parts (with firmware to extract and reverse-engineer)
Show thread✧✦Catherine✦✧Jun 11

everyone who follows the news knows the UA side is proudly using Ardupilot

however nobody seems to know what the RU side is using. time to find out, i have an STM32 on my desk and a glasgow with newly added SWD support

Show thread✧✦Catherine✦✧Jun 11
weapons
Show thread✧✦Catherine✦✧Jun 11

i need these two pins for SWD

at the factory, they most likely used serial programming, which i don't want to use as i'm unfamiliar with it and it's not even easier (the board has an RS232 level shifter, etc)

Show thread✧✦Catherine✦✧Jun 11

ok, now i just need to power it

conveniently, there is silk that explains how to do that

it uses an LDO, so i don't think i actually need +24V, probably anything above 5V will work. i'll hook it up to a current limited supply first

Show thread✧✦Catherine✦✧Jun 11

as expected, we have trouble! it draws like 1.5 watts while the supply is sagging down to 3.6 V. those 1.5 watts are going somewhere, and it sure as heck isn't the STM32 or the ublox M8! time for some thermal imaging

the fusion is pretty bad at this distance, but it's probably this capacitor has broken down

Show thread✧✦Catherine✦✧Jun 11
it was an identical capacitor on the other side. and i had to find out with my finger, because it got hot but not hot enough to instantly evaporate IPA (i was conservative with current)
Show thread✧✦Catherine✦✧Jun 11

after spending 30 minutes fucking around with the grabber hooks (never use these. seriously. just solder a wire or something. you'll only short out your DUT with the hooks) i discovered that one of the connectors on the board actually just has SWD on it

? SWCLK GND SWDIO ?

also it seems to be a 1.8 V IO bank

Show thread✧✦Catherine✦✧Jun 11

nope i'm wrong, it just doesn't work properly on anything under 24 V (i'm not sure why i thought it would. bad assumptions)

and it's just a normal 3.3 V design

Show thread✧✦Catherine✦✧Jun 11
Here we go
Show thread✧✦Catherine✦✧Jun 11

ok, new problem

it responds over SWD... sometimes

i _think_ the board is attempting to boot and in the process of that browning out and resetting itself. maybe the u-blox has some dead capacitors, maybe something else; this is difficult to diagnose. all i know the power LED seems to go out briefly every second and the SWD interface doesn't work consistently

Show thread✧✦Catherine✦✧Jun 11

conveniently they put NRST on the same debug connector

so it's

RESET SWDIO GND SWCLK ?

Show thread✧✦Catherine✦✧Jun 11

okay, it doesn't seem to brown out any more, and probe-rs no longer crashes with an SWD error

however, because enough ROM tables are in reset, i can't get `probe-rs info` to work

Show thread✧✦Catherine✦✧Jun 11
for unclear reasons probe-rs continues to crash in some odd ways, so i think i have no choice but to grab ADIv5.2 and try to read the firmware myself? i have really not expected to have to do this...
Show thread✧✦Catherine✦✧Jun 11

the problem with this is that this is an uhhhhhh very special device

jebani dostawcy

Show thread✧✦Catherine✦✧Jun 11
at least the docs explain which of the three AXI MEM-APs belong to what
Show thread✧✦Catherine✦✧Jun 11
fortunately, glasgow lets you write scripts, so i wrote this quick script that lets me read memory while ignoring all errors by resetting the SWD interface whenever they happen
Show thread✧✦Catherine✦✧Jun 11

oops i was reading ITCM instead of Flash which is at 0x08000000

now _this_ looks like code (the very start of the firmware doesn't have anything interesting in it)

Show thread✧✦Catherine✦✧Jun 11

(holding "identifying firmware" book)

yep. that's firmware

Show thread✧✦Catherine✦✧Jun 11

based on strings in the firmware, it looks like it's using this exact STM32 bootloader

the bootloader repo is over 300 MB in size because they checked in a build of an Android app that you can use to reflash the thing

https://github.com/Embetronicx/STM32-Bootloader

GitHub - Embetronicx/STM32-Bootloader: STM32 Custom Bootloader from scratch

STM32 Custom Bootloader from scratch. Contribute to Embetronicx/STM32-Bootloader development by creating an account on GitHub.

GitHub
Show thread✧✦Catherine✦✧Jun 11

perfect match

(the \n was probably chomped off by clang as it turned printf into puts. yes, this is a valid optimization it does)

Show thread✧✦Catherine✦✧Jun 11

besides one or two functions in the bootloader, there are no strings in the firmware

the application section is a 128K blob full of vector floating point instructions. this is going to be extremely challenging to reverse engineer

Show thread✧✦Catherine✦✧Jun 11

okay i think i know why it was unstable

remember that broken down capacitor that i removed? it was on the VIN pin of a TPS5430 buck converter. and TPS5430 really, _really_ wanted its VIN pin to be bypassed

Show thread✧✦Catherine✦✧Jun 11
implemented memory dumping via SWD so that you don't have to rely on other tools that may or may not be able to identify the chip https://github.com/GlasgowEmbedded/glasgow/pull/898
Implement memory dumping via SWD probe by whitequark · Pull Request #898 · GlasgowEmbedded/glasgow

This avoids the need to use a debugger or identify the chip in any way, hence it works well for reverse-engineering.

GitHub
Show thread✧✦Catherine✦✧Jun 11

looking at this firmware: it has no strings (except in the bootloader), very little structure i can recognize, and is basically a 128K sized blob of numeric code

i don't think it's one of the popular open-source firmwares. definitely not as-is, and probably not even a modified one; i would expect vtables, command parsers, stuff like that; none of it is there

Show thread✧✦Catherine✦✧Jun 11

when reverse-engineering embedded devices, i like to make these overlays

to make one yourself, open the datasheet screenshot in gimp, use "select by color" on the _black_ (this is important), grow the border by 1-3 px, copy the selection, paste onto a photo, and use universal transform until it matches

Show thread✧✦Catherine✦✧Jun 11

here's another one

i had to expand the u-blox symbol a bit since they didn't quite get the spacing right

Show thread✧✦Catherine✦✧Jun 11

for some reason people expect military firmware to do things like "code protection", "encryption", or "obfuscation"

they forget this firmware is usually made in a rush, by the lowest bidder, and (quite likely) by someone who doesn't really care about the craft

i have never seen any RE countermeasures

Show thread✧✦Catherine✦✧Jun 11
the end result of connectivity extraction for me is usually these tables
Show thread✧✦Catherine✦✧Jun 11

i played myself, the firmware doesn't actually use the SDMMC1 peripheral except to enable its power :/

and i'm fairly sure it's not being used with the SPI peripheral either, given PC8 is connected to DAT0/MISO

Show thread✧✦Catherine✦✧

i've never seen resistor markings like this

are these jumpers?

Jun 11 at 9:53pmWeb
Show thread✧✦Catherine✦✧Jun 11

i'm going to make a bet that nobody has tried to reverse-engineer Thumb code with VFP instructions in Binary Ninja before

i opened one trivial function and immediately found three bugs, one of which is a show-stopper

https://github.com/Vector35/binaryninja-api/issues/6945
https://github.com/Vector35/binaryninja-api/issues/6946
https://github.com/Vector35/binaryninja-api/issues/6947

Show thread✧✦Catherine✦✧Jun 12

implemented a glasgow applet for sniffing conversations over UART with accurate sequencing; this will be used for finding out how the MCU talks to the GPS module

https://github.com/GlasgowEmbedded/glasgow/pull/899

Add an UART sniffer applet by whitequark · Pull Request #899 · GlasgowEmbedded/glasgow

On the command line this applet admits only two channels, rx and tx, but when UARTAnalyzerInterface is used directly, up to 64 channels may be used.

GitHub
Show thread✧✦Catherine✦✧Jun 12

just realized that i can't exactly expect this device to work as intended right now, because it doesn't have its IMU

and it needs an IMU, alongside GPS, to know where it is

Show thread✧✦Catherine✦✧Jun 12
using the new `uart-analyzer` applet i have obtained the exchange between the MCU and the GNSS module. it is a binary stream in a format unknown to me. for obvious reasons i will not be posting a screenshot of it
Show thread✧✦Catherine✦✧Jun 12

of _course_ this device pair is being annoying and switching UART speed at runtime

i didn't implement autobaud in uart-analyzer applet because i thought it 'would not be that important'. agh

Show thread✧✦Catherine✦✧Jun 12

adding proper autobaud is fairly tricky for the analyzer, but i did at least add per-channel baud (i.e. you can have different baud rates for RX and TX)

an online ublox protocol decoder (implemented e.g. as a script) could promptly switch baud rates when it observes a command to do so

Show thread✧✦Catherine✦✧Jun 12

i've reverse-engineered the entire state machine in the firmware. it only parses three messages! these are:

UBX-NAV-PVT
UBX-NAV-SOL
UBX-NAV-SAT

once again, the firmware is... simple. every part i can understand does exactly one thing, in the most uncomplicated way possible

Show thread✧✦Catherine✦✧Jun 12
i think this has a buffer overflow
Show thread✧✦Catherine✦✧Jun 13

yeah, it reads data from the GNSS module into a preallocated buffer that has space for about 32 satellites (i'm not clear on how many exactly but definitely not more than that)

the GNSS module has 72 channels

Show thread✧✦Catherine✦✧Jun 13
... i think this is technically a 0day?..
Show thread✧✦Catherine✦✧Jun 13

so, after close examination, i think the device currently in my hands isn't an autopilot or the like. its job is solely to grab a stream of radio frequency data from a CRPA, to do some form of processing on it, and to spit it out in form of a rapid (saturating the UART) stream of telemetry somewhere else (after combining with IMU data)

apparently there are raspberry pis involved at one stage

Show thread✧✦Catherine✦✧Jun 13
i feel like after seeing raspberry pis in loitering munitions i can pack my embedded career up. there's nothing more to be seen at this point
Show thread✧✦Catherine✦✧Jun 13
reportedly the actual autopilot role is taken up by multiple TMS320's and i have absolutely no desire to stare at TMS320 assembly. bizarre choice of device to design in
Show threadAndrew ZonenbergJun 13
@whitequark TMS320s are all over the place in western munitions too. Not surprised in the slightest
Show thread✧✦Catherine✦✧Jun 13
@azonenberg apparently russia has cloned TMS320's long ago but... they don't use the clones? they use actual western TI TMS320's? they don't even come in the same package??
Show threadAndrew ZonenbergJun 13
@whitequark probably easier to find in a dumpster in guangzhou? lol
Show thread✧✦Catherine✦✧Jun 13
@azonenberg yeah I suppose in the same dumpster they get AD and ublox parts
Show threadJoel MichaelJun 13
@whitequark @azonenberg and judging by the photos, the u-blox parts definitely came out of a dumpster because it’s missing the RF shield
Show thread✧✦Catherine✦✧Jun 13
@jpm @azonenberg there are many examples with shields, i think this happened somewhere in the my 'supply chain'
Show threadJoel MichaelJun 14
@whitequark @azonenberg aha gotcha
Show threadRJun 13
@azonenberg @whitequark china has access to both TI parts *and* chinese domestic clones https://lcsc.com/product-detail/Digital-Signal-Processors-DSP-DSC_CHIPLON-CLM320VC5402PGE100_C437258.html?s_z=n_320
CLM320VC5402PGE100 | CHIPLON | Price | In Stock | LCSC Electronics

CLM320VC5402PGE100 by CHIPLON - In-stock components at LCSC. Price from $11.2398. Free access CLM320VC5402PGE100 datasheet, Package, pinout diagrams, and BOM tools.

LCSC Electronics
Show thread✧✦Catherine✦✧Jun 13
@r @azonenberg nothing cloned here
Show threadRJun 13

@whitequark @azonenberg oh wow, something about this feels *very* "familiar" and not at all like what we expected a weapon to look like

other than the chonky connectors, it feels like any other bit of standard industrial kit (esp. something about the large ugly fiducials and the pile of "QC passed" stickers)

Show thread✧✦Catherine✦✧Jun 13
@r @azonenberg this too, presumably
Show threadJoel MichaelJun 13
@whitequark military-grade code!
Show threadRidley @ WATCH LYCORECOJun 13
@whitequark what would be the correct way to responsibly disclose this (to the SBU)
Show thread✧✦Catherine✦✧Jun 13

@rcombs beats me

but i also would expect the SBU to know basic shit like this already. to the best of my knowledge the devices i have are of little operational interest, Ukrainian electronic warfare is far ahead of what these devices can tolerate

Show threadSnowFoxJun 13
@rcombs @whitequark This is a good example of why I don't like the term "responsible disclosure".
Show threadmaswanJun 13
@whitequark
Is it one a few ukrainians might be interested in being tagged into this thread, or are we assuming they are already reading it with interest?
Show thread✧✦Catherine✦✧Jun 13
@maswan i honestly have no idea and don't want to be presumptious
Show threadmaswanJun 13

@whitequark Yeah, it's tricky, and hard to know if it is old stuff to the people really working on this in UA.

But on the other hand if there is even a 5% chance that this could be a useful way of disabling hundreds of drones, it would be nice if they got it sooner rather than later.

Show thread✧✦Catherine✦✧Jun 13
@maswan i'm almost completely certain that this would add nothing over the existing EW efforts even if you somehow got the entire chain to work
Show threadMäh W.Jun 13
@whitequark weapon 0day exploit development 😏
Show threadJoel MichaelJun 12
@whitequark *giggle*
Show threadJoel MichaelJun 12

@whitequark

UBX-NAV-PVT length = 92 bytes
UBX-NAV-SOL length = 52 bytes
UBX-NAV-SAT length = how many satellites can you see right now?

Show threadchrisgj198Jun 13
@jpm @whitequark I wonder what happens if you give the GPS receiver signals from too many satellites (well, pretend satellites ideally). There is likely some limit (possibly implemented safely) in the GPS firmware but it may still be higher than the length of this buffer...
Show thread✧✦Catherine✦✧Jun 13

@chrisgj198 @jpm it overflows the buffer

i don't know how long it is exactly because it appears to never check the buffer but it's like half the module channel count

Show threadchrisgj198Jun 13
@whitequark @jpm I hope something important is right after this buffer then. A suitable GNSS simulator might be quite easy to make if the bitstream could be pre-computed and just played back into a mixer with appropriate LO.
Show thread✧✦Catherine✦✧Jun 13

@chrisgj198 @jpm i could also just feed it the ublox binary messages; same result for less effort (with the caveat that i don't know if the ublox module will actually emit such long messages in any practical environment)

i _really_ don't want to mess with GNSS signals too much, since if they leak i'll get a not-so-friendly visit from Ofcom and it'll be 100% deserved

Show threadchrisgj198Jun 13
@whitequark @jpm I was more thinking of how it would behave in its natural habitat, where the serial port is inaccessible. I agree that during investigations you should limit the power of any transmissions such that nobody else notices them.
Show thread✧✦Catherine✦✧Jun 13
@chrisgj198 @jpm my understanding (based on talking to someone who worked with GNSS emulators) is that it's particularly difficult to limit the power of GNSS transmissions, seeing as receivers will pull them from well below the thermal noise floor
Show threadchrisgj198Jun 13
@whitequark @jpm True, but the inverse square law is pretty effective, if you don't vastly exceed the power that you need. Maybe attenuating one of the signals *before* mixing would give more certainty that the signal that you don't want to escape doesn't exist anywhere at high power.
Show thread✧✦Catherine✦✧Jun 13
@chrisgj198 @jpm I do feel that I'm not skilled enough to properly attempt this
Show threadchrisgj198Jun 13
@whitequark @jpm I think you are, partly because of the caution with which you approach the topic.
Show threadchrisgj198Jun 13
@whitequark @jpm You would want some good stepped attenuators and some receiver ( SDR or spectrum analyser) so that you can verify the amount of leakage (modulated with a simple tone) before you feed it the right bitstream though.
Show threadrevenge of the boltzmann brainJun 13
@chrisgj198 @whitequark @jpm something like this https://github.com/osqzss/LimeGPS ?
GitHub - osqzss/LimeGPS: Real-time GPS signal simulator for LimeSDR

Real-time GPS signal simulator for LimeSDR. Contribute to osqzss/LimeGPS development by creating an account on GitHub.

GitHub
Show threadDusty Jun 12
@whitequark clearly they should’ve written it in rust /s
Show threadAndrew ZonenbergJun 12
@whitequark wait what it's dynamically changing the uart speed? Between what bauds?
Show thread✧✦Catherine✦✧Jun 12
@azonenberg 9600->115200
Show threadJoel MichaelJun 12

@whitequark @azonenberg yep u-blox receivers can do this, there’s a command sequence from the host to the receiver that does it.

And in the intended application, it makes sense to do so because I’ll bet one of the next commands is to increase the frequency of navigation messages up from the default of 1Hz

Show threadAndrew ZonenbergJun 12

@jpm @whitequark Yeah it makes sense to run fast, booting at 9600 doesn't.

can you not just nonvolatile-ly configure the ublox to boot up at 115200 out of the box?

Show threadwickedshellJun 12
@azonenberg @jpm @whitequark you can, but that still has to be done at some point, and you don't want to make assumptions about what changes with different firmware versions, or if the receiver dumps the configuration (I've seen all of the above catch people out)
Show threadJoel MichaelJun 12
@azonenberg @whitequark booting at 9600 does make sense because factory config spits out NMEA at 1Hz. It also depends on exactly which receiver in the range it is, only some have actual non-volatile flash for storing configuration, the rest are only non-volatile as long as battery backup power is applied…
Show threadpoleguy looking for lost toolsJun 12
@whitequark @azonenberg The Wayne Gretzkys of baud rate.
Show threadwickedshellJun 12
@whitequark particularly common for figuring out where a ublox device is. (ArduPilot does the same thing)
Show threadAndrew ZonenbergJun 12
@whitequark the missile doesn't know where it is because it doesn't know where it wasn't?
Show thread✧✦Catherine✦✧Jun 12
@azonenberg it's not a missile! it's a loitering munition
Show thread✧✦Catherine✦✧Jun 12

@azonenberg actually i'm not sure what this specific device should be called because it shouldn't have carried a warhead, it's a decoy

is that still a munition? i guess it is