Stefan Gloor

@stgl@infosec.exchange
130 Followers
112 Following
31 Posts

Likes to develop and break embedded things🐧
Electrical engineer by training, currently working as an embedded software developer. Interested in all things electronics, microcontrollers, computers, open source, security, and Linux

https://stefan-gloor.ch

Some people have asked and I saw some demand in my logs, so I added an RSS feed to my blog (https://stefan-gloor.ch)

https://stefan-gloor.ch/rss.xml

Let me know if there are any problems!

Check out my project page!

Hardware, Linux, Embedded Systems

🪥 Reverse Engineering der Oral-B iO: Firmware & Hardware im Überblick!
🔧 HW: PSoC4, CC2642, 128×64 OLED, W25Q64JV (GALEP-5), J-Link
💻 SW: Ghidra + Python-Skripte, Bitmap-Header-Suche (0x80 00 40 00), Entropie-Checks
➡️ Einblicke in Zerlegen, Flash-Dump & automatisierte Grafikauslese!

#ReverseEngineering #EmbeddedSystems #Firmware #PSoC4 #Ghidra #HardwareHacking #IoT #Python

[Blog:] Ophanim, or, How many angels can dance on a circuit board

The OPHANIM sensor board from CERN's AEgIS project is an absolute delight

https://christianmoe.com/en/blog/2025/Ophanim

#science #religion #mysticism #art #CERN

1/2

[commenting: see below]

C. Moe | Ophanim

The OPHANIM sensor board from CERN's Aegis project is an absolute delight

First successful upload of a bytepatched Firmware onto the 25€ Aliexpress BLE Smart Ring with Display🥳 Thats code execution🙌
https://s.click.aliexpress.com/e/_oF0OCxZ (Affiliate link)

Who will I meet at 38C3?

2024 New RS08 Smart Ring 5ATM Waterproof Health Rate Blood Oxygen Monitoring Fitness Rings Multi Sports Modes for Men Women - AliExpress 44

Smarter Shopping, Better Living! Aliexpress.com

aliexpress.

It finally happened, found a full buffer overflow + exploit for the first time🥳

The target, The Signed OTA of the Xiaomi Thermometer (2.1.1_0159)

This now enables a full OTA update to custom firmware.
Will be shared later

The BLE Keys need to be known to do this,still all OTA

Dear Fediverse, does anyone have material on how to bypass readout protection on a dsPIC33F?
Signal integrity is apparently not that critical for external flash.
Hacking a VoIP Phone