3

I'm planning to edit the binary Firmware for an STM32F030K6T6 ARM microcontroller used in the IKEA Fyrtur blinds. In particular I'm trying to

  • disable the Voltage check (allow alternative power source)
  • increase the max length, aka max motor rotation (allow longer blinds)
  • decrease the operating speed (reduce noise)

There exists a custom firmware already that does this (and a lot more). Unfortunately it is very buggy, so I've decided to investigate modifying the original firmware.

I've used radare2 to decompile the binary, following this guide, but I'm unable to identify the relevant parts in the code.

I think that, using the custom firmware as a reference, we should at least be able to figure out where the Voltage is being read and what happens with it. The custom firmware also includes the default values for the three settings I want to edit.

I'm looking for some resources and a structured approach here as I am new to using radare2 and decompilation of arm instructions. Are there some plugins / other tools that I should be using?

Here are details on how to reproduce what I've done so far (using docker):

  • Download binary with wget https://github.com/dominikkarall/fyrtur-motor-board/raw/main/bin/original-fyrtur-fw.bin (alternatively can be dumped from the IKEA Blinds)
  • Start radare2 docker container with docker run --net host -v $(pwd):/user/project -w /user/project -it --entrypoint /bin/bash radare/radare2
  • In docker container start radare2 with r2 -a arm -b 16 -m 0x80000000 -w original-fyrtur-fw.bin
  • Analyze and decompile with
aaaa
pdf @@ fcn* > pdf.txt
pdc @@ fcn* > pdc.txt
Improve this question
1
  • Nice idea! My first priority is changing the speed For my binary changes on the fyrtur cfw posted on github, i think i have used ghidra which is able to decompile arm code. Will also take look at it when i find time. Did you made any progress which you can share with us? popy2k14
    – popy
    Commented Jun 29, 2022 at 10:31

1 Answer 1

Reset to default
1

You can use iaito to use the radar more easily. I also recommend cutter. But for reverse engineering, I suggest not to rely on tools. You have to look for clues. For example, follow input pins and interrupts.For this, you can write a simple code for this processor. Then analyze its .out file. Now look for similar events in your firmware. For example, define some pins that controls the motor in your project and find it inside your .out file. Now try to find the same pin inside the main firmware.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.