dev-zzo

Mitsubishi / Renesas MCUs

Distinct feature: pins RESET, XOUT, VSS, XIN, VDD go in a group, and accept a ceramic resonator.

M16C MCUs

Family	Packages	Doc.no.
M16C/1N	48P6Q-A	REJ09B0007
M16C/26	48P6Q	REU09B0001

dev-zzo

The list below is compiled to inform, guide, and inspire budding security researchers. Oh and to pick something for bedtime reading too.

Included in the list are works on the following topics related to MCU/SoC security:

• Secure boot
• Fault injection
• Side channel attacks

At the end of the list, there is also a section with links to articles of potential general interest, not addressing vulnerabilities in any specific device.

dev-zzo

#!/usr/bin/env python3

import sys
import io

from pcsc import PcScTransport

def h2b(x):
    return bytes.fromhex(x)

dev-zzo

Clone required things

$ git clone https://github.com/TechNexion/u-boot-edm
$ git clone https://github.com/boundarydevices/imx_usb_loader

Build u-boot

setup your toolchain here e.g. set PATH to where your toolchain is and e.g. CROSS_COMPILE=arm-linux-gnueabihf-

dev-zzo

.UPD780101
.UPD780102
.UPD780103
; U15836EJ5V0UD00

; MEMORY MAP
area DATA ROM      0x0000:0x6000   Internal ROM
area DATA RAM      0xFC00:0xFF00   Internal High-Speed RAM
area DATA SFR      0xFF00:0x10000  Special Function Register

dev-zzo

import sys
import os
import os.path
import math
from collections import namedtuple
# screw this
os.environ["OPENCV_IO_MAX_IMAGE_PIXELS"] = str(pow(2,40))
import cv2 as cv

PointBase = namedtuple("Point", ("x", "y", "z"), defaults=(0, 0, 0))

dev-zzo

<?xml version="1.0"?>
<root xmlns="urn:schemas-upnp-org:device-1-0">
  <specVersion>
    <major>1</major>
    <minor>0</minor>
  </specVersion>
  <URLBase>http://172.16.90.254:49152</URLBase>
  <device>
    <deviceType>urn:schemas-upnp-org:device:InternetGatewayDevice:1</deviceType>
    <friendlyName>Cisco VPN Router</friendlyName>

dev-zzo

eMMC reballing

The same technique should work well with other (bigger) ball sizes too, however there are rarely issues when handling bigger packages and less care is usually needed there.

The technique uses premade solder balls, not solder paste.

Equipment:

• Solder balls of correct size (0.3mm for eMMC)
• Stencil to hold the balls with correct configuration for the package eg eMMC 153/169 standard stencil

dev-zzo

Getting it to work

The device is shipped with test firmware installed. To burn a proper firmware, you will need:

• Atmel USB DFU Programmer from https://sourceforge.net/projects/dfu-programmer/
• Actual firmware files, which in worst case scenario you have to build yourself
• Incorrect instructions from https://store.ryscc.com/blogs/news/upgrading-the-firmware-on-a-chameleonmini
• Correct instructions (and a .bat file) in the firmware documentation

The instructions on the blog page are incorrect because Rev G hardware uses ATxmega128A4U instead of ATxmega32A4U. Why? Probably an outdated version of hardware.

dev-zzo

import struct

class BetterStructMeta(type):
    def __new__(cls, clsname, superclasses, attributedict):
        if clsname != 'BetterStruct':
            fields = attributedict['__fields__']
            field_types = [ _[0] for _ in fields ]
            field_names = [ _[1] for _ in fields if _[1] is not None ]
            size = 0
            for fielddef in fields: