4

I am doing some research into smart devices. I realized that the device is communicating with an Internet end-point but the communication is encrypted (and using a proxy tool doesn't work).

I want to see if I can reverse engineer the firmware or get access to the scripts on the controller to further analyse the functionality. enter image description here

  • First, remove the sticker from the chip to get the part's ID so we can look up the data sheet and help you. At first glance this looks like a Kevo Hub for smart locks with a Power plug, a Ethernet port and an antenna mount. You'll be most likely dealing with an ARM SoC given the size of what I see. – yaspr Jan 6 '18 at 17:18
  • you are right about the kevo plus, the chip indeed is an ARM CPU digikey.sg/product-detail/en/nxp-usa-inc/MK60DN512VLL10/… – Lucas Kauffman Jan 7 '18 at 4:49
  • as numind suggest you should download datasheet/pinout and look which pins are connected to the connectors. Also take a look at this Thought I found serial port - broke embedded device instead! Help? see both answers – Spektre Jan 7 '18 at 12:17
  • Be sure to try those test points, and other potentials, to see if you have an accessible RS232 (serial) connection. Find a 3.3v source and then check for I/O from the pins/points, which may appear as garbage. From there, determine the baud rate in use so you aren't getting garbage. Hopefully it isn't encrypted or otherwise disabled. A good serial shell may allow you to dump the FLASH or otherwise interact with the OS in easier ways. Case in point, look where I found serial on this little router years ago: bitsum.com/openwiking/owbase/WL530G – dyasta Jan 11 '18 at 16:28
5

J2 looks suspiciously close to the classic ARM 20-pin JTAG connector

| improve this answer | |
  • The chipset is ARM powered – Lucas Kauffman Jan 7 '18 at 4:44
  • I am a complete newbie to this, I assume I probably need to solder some connector pins onto that J2. Then I will need some type of cable to connect to a computer? – Lucas Kauffman Jan 7 '18 at 5:01
2

Well, the fastest way is get datasheet of MCU and test data pins for get JTAG access and dump main code from RAM. Also you can measure pin volts looking for 3.3v and place Rx and Tx rs232 for get console.

Else if you dont have JTAG access you should start to think about desolder flash chip (in case it exists) but in this case the code seems to be written into flash area of the MCU.

So finally successful depends on IC security...Maybe some some glitch at the right place and moment could help as well..

Good luck

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.