I have been playing with some robot vacuums that utilize very basic navigation, and I am wanting to play around with my own provisioning along with adding a Rpi to augment features. These vacuums are using the STM32F0 MCU, and when using a debugger to dump the firmware it turns out they are all using RDP1.

Through some digging, I found a public S3 bucket with various firmware images along with other resources. Oddly, the newer generation vacuums referenced in the bucket have their firmware images without encryption/obfuscation. The binaries for the vacuums I am interested in all have a type of encryption/obfuscation that seems very weak. The thing is though, no matter how I try attacking it, I do not seem to get my rewards.

I say it is weak because there are decent size segments within the images that have 136byte strings that will repeat anywhere from 15 to 236 times depending on the image type. These repeating parts only repeat the same segment consecutively, and the string dose not occur again outside of the repeated segment. Some of the smaller firmware images only have 2 blocks of repeating segments, other larger images may have up to six that I have seen. Here is an example of one of the images. Robot Vacuum Firmware

The first WORD is 0xEAAF4339, and is common to all of the images. The second WORD seems to be a file type flag. The third WORD is almost always equal to the image size minus 24 bytes. The fourth WORD is always padding. The fifth WORD is always 0x0403020F. Starting at 0x4418 is the first segment of repeating 136 bytes.



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.