Stefan Gloor

@stgl@infosec.exchange
130 Followers
112 Following
31 Posts

Likes to develop and break embedded things🐧
Electrical engineer by training, currently working as an embedded software developer. Interested in all things electronics, microcontrollers, computers, open source, security, and Linux

https://stefan-gloor.ch

Stefan GloorJun 3

Some people have asked and I saw some demand in my logs, so I added an RSS feed to my blog (https://stefan-gloor.ch)

https://stefan-gloor.ch/rss.xml

Let me know if there are any problems!

Check out my project page!

Hardware, Linux, Embedded Systems

Stefan GloorJun 2
reverse:luckeJun 2

🪥 Reverse Engineering der Oral-B iO: Firmware & Hardware im Überblick!
🔧 HW: PSoC4, CC2642, 128×64 OLED, W25Q64JV (GALEP-5), J-Link
💻 SW: Ghidra + Python-Skripte, Bitmap-Header-Suche (0x80 00 40 00), Entropie-Checks
➡️ Einblicke in Zerlegen, Flash-Dump & automatisierte Grafikauslese!

#ReverseEngineering #EmbeddedSystems #Firmware #PSoC4 #Ghidra #HardwareHacking #IoT #Python

Stefan GloorJun 1

New blog post!

How I got a Root Shell on a Credit Card terminal

https://stefan-gloor.ch/yomani-hack

#reverse_engineering #reverseengineering #hardwarehacking #hacking #security

Stefan GloorMay 27
Owlet of MinervaApr 11

[Blog:] Ophanim, or, How many angels can dance on a circuit board

The OPHANIM sensor board from CERN's AEgIS project is an absolute delight

https://christianmoe.com/en/blog/2025/Ophanim

#science #religion #mysticism #art #CERN

1/2

[commenting: see below]

C. Moe | Ophanim

The OPHANIM sensor board from CERN's Aegis project is an absolute delight

Stefan GloorJan 25
Atc1441Dec 26

First successful upload of a bytepatched Firmware onto the 25€ Aliexpress BLE Smart Ring with Display🥳 Thats code execution🙌
https://s.click.aliexpress.com/e/_oF0OCxZ (Affiliate link)

Who will I meet at 38C3?

2024 New RS08 Smart Ring 5ATM Waterproof Health Rate Blood Oxygen Monitoring Fitness Rings Multi Sports Modes for Men Women - AliExpress 44

Smarter Shopping, Better Living! Aliexpress.com

aliexpress.
Stefan GloorJan 25
Atc1441Jan 12

It finally happened, found a full buffer overflow + exploit for the first time🥳

The target, The Signed OTA of the Xiaomi Thermometer (2.1.1_0159)

This now enables a full OTA update to custom firmware.
Will be shared later

The BLE Keys need to be known to do this,still all OTA

Stefan GloorJan 24
Hal 9000Jan 24
Dear Fediverse, does anyone have material on how to bypass readout protection on a dsPIC33F?
Stefan GloorJan 24
Signal integrity is apparently not that critical for external flash.
Stefan GloorAug 9, 2024

I finished my little side project.
https://stefan-gloor.ch/voip-phone-hack

#DOOM #reverseengineering #hacking

Hacking a VoIP Phone

×
Atc1441Jan 12

It finally happened, found a full buffer overflow + exploit for the first time🥳

The target, The Signed OTA of the Xiaomi Thermometer (2.1.1_0159)

This now enables a full OTA update to custom firmware.
Will be shared later

The BLE Keys need to be known to do this,still all OTA

Show threadAtc1441Jan 12
Video demo of the MiThermometer OTA firmware upload Exploit:
https://youtu.be/NfZHh6wmTp8
ATC_MiThermometer 2.1.1_0159 OTA Firmware upload exploit Xiaomi Thermometer

YouTube
Show threadAtc1441Jan 13

Exploit firmware is now released and can be flashed as shown in the video above:
https://github.com/atc1441/ATC_MiThermometer/blob/master/ATC_Exploit.bin

This allows to free the Xiaomi Thermometer running 2.1.1_0159 firmware and upload the custom firmware from which you can go to any other wanted firmware OTA

ATC_MiThermometer/ATC_Exploit.bin at master · atc1441/ATC_MiThermometer

Custom firmware for the Xiaomi Thermometer LYWSD03MMC and Telink Flasher via USB to Serial converter - atc1441/ATC_MiThermometer

GitHub
Show threadsb arms & legsJan 12

@Atc1441
Damn! That's GOTTA feel good :)

Enjoy the high!

Show threadRexo the Trans Bus 🏳️‍🌈🏳️‍⚧️🚌Jan 13
@Atc1441 probably basic question but what's the chart depicting? power usage? network traffic?

either way this is really cool :3
Show threadAtc1441Jan 13
@rexo that shows the power usage. The perfect way to know what a device is doing without a debugger even connected
Show threadLisPiJan 13
@Atc1441 @enigmatico Neat, are you going to do a writeup on it?
Show threadFarooq Karimi ZadehJan 13

@Atc1441

Kewl man!

Show threadMixJan 13
@Atc1441 This is so great ! I wanted to use a custom firmware on my thermothers but I discovered that I was stuck because I upgraded them with the xiami app 😅
Thanks for your work ​​
Show threadTaureonJan 13
@Atc1441 big gg