4

I am doing some research into smart devices. I realized that the device is communicating with an Internet end-point but the communication is encrypted (and using a proxy tool doesn't work).

I want to see if I can reverse engineer the firmware or get access to the scripts on the controller to further analyse the functionality. enter image description here

Improve this question
4
  • First, remove the sticker from the chip to get the part's ID so we can look up the data sheet and help you. At first glance this looks like a Kevo Hub for smart locks with a Power plug, a Ethernet port and an antenna mount. You'll be most likely dealing with an ARM SoC given the size of what I see.
    – yaspr
    Jan 6, 2018 at 17:18
  • you are right about the kevo plus, the chip indeed is an ARM CPU digikey.sg/product-detail/en/nxp-usa-inc/MK60DN512VLL10/…
    – Lucas Kauffman
    Jan 7, 2018 at 4:49
  • as numind suggest you should download datasheet/pinout and look which pins are connected to the connectors. Also take a look at this Thought I found serial port - broke embedded device instead! Help? see both answers
    – Spektre
    Jan 7, 2018 at 12:17
  • Be sure to try those test points, and other potentials, to see if you have an accessible RS232 (serial) connection. Find a 3.3v source and then check for I/O from the pins/points, which may appear as garbage. From there, determine the baud rate in use so you aren't getting garbage. Hopefully it isn't encrypted or otherwise disabled. A good serial shell may allow you to dump the FLASH or otherwise interact with the OS in easier ways. Case in point, look where I found serial on this little router years ago: bitsum.com/openwiking/owbase/WL530G
    – dyasta
    Jan 11, 2018 at 16:28

2 Answers 2

Reset to default
5

J2 looks suspiciously close to the classic ARM 20-pin JTAG connector

Improve this answer
2
  • The chipset is ARM powered
    – Lucas Kauffman
    Jan 7, 2018 at 4:44
  • I am a complete newbie to this, I assume I probably need to solder some connector pins onto that J2. Then I will need some type of cable to connect to a computer?
    – Lucas Kauffman
    Jan 7, 2018 at 5:01
2

Well, the fastest way is get datasheet of MCU and test data pins for get JTAG access and dump main code from RAM. Also you can measure pin volts looking for 3.3v and place Rx and Tx rs232 for get console.

Else if you dont have JTAG access you should start to think about desolder flash chip (in case it exists) but in this case the code seems to be written into flash area of the MCU.

So finally successful depends on IC security...Maybe some some glitch at the right place and moment could help as well..

Good luck

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.