PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Recovering an ECU firmware using disassembler and branches

blog.quarkslab.com | research | #reverse-engineering | #firmware | #arm | #automotive | #ecu | #capstone
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

How Quarkslab recovered erased firmware from a fleet-sharing ECU: using the Capstone disassembler and branch analysis to locate scattered code fragments and enable reverse engineering.
Published
Collected

Related coverage

research · blog.quarkslab.com
How I Built a Car In a Box
Building a Car in a Box: how Quarkslab assembled the VAGBox, a transportable setup of several Volkswagen-group ECUs for car hacking training and demos.
research · blog.quarkslab.com
Development of a training ECU
How Quarkslab built a low-cost, open-source training ECU (Teensy 3.2, CAN transceiver, sensors and actuators) so car-hacking trainees can attack it freely without risking a real vehicle.
research · blog.quarkslab.com
Tearing down a car telematic unit (and finding an accident on Facebook)
Quarkslab tore down a second-hand BYD telematic unit (Snapdragon MDM9628, NAND flash), extracted firmware and stored data, then combined forensics with OSINT.
research · blog.quarkslab.com
Bypassing debug password protection on the RH850 family using fault injection
Quarkslab bypasses the 16-byte IDCODE debug password on several Renesas RH850 automotive microcontroller variants using voltage fault injection, enabling firmware extraction in black-box audits.
research · blog.quarkslab.com
EVerest security audit
Quarkslab's first public security audit of EVerest, the open-source EV charging stack: 6 high, 6 medium and 5 low severity issues found, including RFID cloning and several DoS flaws.
research · blog.quarkslab.com
Audit of Kuksa, the open-source shared building blocks for Software Defined Vehicles
Quarkslab's OSTIF-organized audit of Eclipse Kuksa: static analysis and fuzzing of the KUKSA.val databroker and Python SDK surfaced 19 vulnerabilities, including two high-severity crashes.
Back