Hardware Hacking Bootcamp

This five day course is designed to teach the fundamentals of hardware reverse engineering and analysis. With a focus on understanding the low level protocols that make up embedded systems, students learn how interfaces such as SPI, I2C, JTAG, SWD work while developing tools to interface with these protocols. All hardware is provided for this course, and is kept by the students upon completion of the course.

2022 Public Offerings

Use the links below to register for a public training. Public offerings are taught remotely via Discord. All five offerings in 2021 were sold out so register early if possible!

March 2022 Registration - SOLD OUT! June 2022 Registration September 2022 Registration November 2022 Registration

Course Objectives

After participating in this course, students will have experience with:

  • Non-Invasive hardware analysis (component identification, etc)
  • Tracing and identifying points of interest on PCBs
  • Extracting firmware over multiple interfaces
  • Unpacking / analyzing binary blobs
  • Attacking hardware debuggers (JTAG,ETC)
  • Modifying, repacking and reflashing firmware
Students will learn how to augment existing tools to work around problems that may arise when extracting firmware.

Labs include how to extract SPI/I2C based flash chips, discover and gain access to consoles using UART, and identify, enumerate and actuate hardware level debuggers such as JTAG and SWD.

All exercises and laboratories are performed using open source tooling on a Raspberry Pi. The Raspberry Pi will be used to attack and exploit all of the targets included in the kit. The tools and techniques used throughout the course were chosen specifically due to their portability across various hardware platforms.

Course Structure

This course includes multiple modules, one for each protocol of interest. For each module, we will perform the following:

  • Protocol Overview and Analysis
  • Understanding and Reviewing Captured Protocol Traffic
  • Protocol Analysis from a Reverse Engineering Perspective
  • Tools for Reverse Engineering Specific Protocols
  • Practical Attacks and Applications on Provided Targets
After each protocol module, a target analysis will be performed to reinforce what was learned in the analysis segment. Using this knowledge, students will perform hardware attacks on the targets included in their kits.

Course Modules

Objectives

  • Understand how PCBs are designed and made
  • Review the various component types that make up PCBs
  • Learn how to determine components and locations of interest
  • Apply the information learned to the analysis of platform one

Objectives

  • Review all tools included in the kit
  • Understand Raspberry Pi setup and customization
  • Logic analyzer review and usage
  • Multimeter usage and examples
  • Platform Overview

Objectives

  • Objective 1: Learn how UART functions and what it is used for
  • Objective 2: Learn how to detect an active UART on a PCB
  • Objective 3: Learn how to calculate an unknown baud rate
  • Objective 4: Learn how to set up UART analyzers in Pulseview
  • Objective 5: Learn how to use the Raspberry PI as a UART interface
  • Objective 6: Discover and interface with a UART on the target router

Labs - Target: Router

  • Calculating Baud Rates
  • Unknown Formatting
  • Python Scripting
  • Router Analysis
  • Console Analysis

Objectives

  • Review what UBoot is and how it is used
  • Understand UBoot environment and console commands
  • Learn how to manipulate environment variables to gain access to systems
  • Learn how to script UBoot console interactions with Python

Labs - Target: Virtual Machine / Router

  • UBoot Shell Analysis
  • UBoot Shell Exploration and Data Collection
  • UBoot Shell Manioulation / Modifications
  • Router Shell Exploration and Data Collection
  • Memory Extraction via Python Scripting

Objectives

  • Learn how the SPI interface works and what components utilize it
  • Identify SPI transactions at the signal level
  • Identify SPI commands and transactions at a protocol level
  • Set up SPI decoder with logic analyzer
  • Extract SPI flash with flashrom
  • Bonus: Interface with a SPI device using Python

Labs - Target: Router

  • Understanding SPI Transactions
  • Analyzing EEPROM Commands
  • Analyzing EEPROM Reads / Writes
  • Using Flashrom to extract router firmware

Objectives

  • Learn how to perform an initial analysis of a firmware blob
  • Learn to extract segments of interest from firmware images via binwalk and dd
  • Extract components of interest from the router firmware image
  • Patch and modify router firmware image to gain advanced access
  • Learn how to repackage and reflash firmware images

Labs - Target: Router

  • Tool Usage: binwalk and dd
  • Component Extraction
  • DTB Analysis and Decompilation
  • Reconstructing a firmware image
  • Re-flashing a firmware image

Objectives

  • Learn and understand how the I2C protocol works
  • Understand how to approach I2C as a reverse engineer
  • Analyze and review I2C traffic and addressing
  • Practice sniffing I2C traffic for data of interest
  • Extract an I2C based memory device
  • Reflash and modify an I2C based memory device

Labs - Target: Game Cabinet

  • I2C Tooling
  • I2C Traffic Analysis
  • Using i2cdump
  • Extracting information with eeprog
  • Modify target flash to gain a high score

Objectives

  • Review and understand the JTAG specification
  • Understand how JTAG scan chains work
  • Identify JTAG pins and pinouts using IDCODE and BYPASS scans
  • Actuate and interface with JTAG ports
  • Assess JTAG ports from a black box perspective
  • Extract and modify memory via JTAG manually and via pre-existing tools

Labs - Target: SSD

  • Identifying Potential JTAG Pinouts
  • Logic Level Shifting
  • Identifying Pin Assignments via IDCODE and BYPASS scans
  • Writing an OpenOCD configuration file
  • Memory extraction and control flow takeover via JTAG

Objectives

  • Review and understand the SWD specification
  • Understand how to identify Serial Wire Debugging
  • Learn how to interface with SWD via OpenOCD
  • How to identify an unknown ARM SoC via SWD
  • Extract firmware via SWD
  • Modify and upload new firmware via SWD

Labs - Target: Controller

  • Identifying SWD Connections
  • Inerfacing with SWD
  • MEM-AP Interfacing and Manipulation
  • Memory Access and Control Flow Takeover
  • Flash Extraction and Analysis

Hardware Targets

Students will receive hardware kit including:

  • Raspberry Pi 4, USBC Cable, Power Supply
  • Travel Router (Target 1)
  • Game Cabinet (Target 2)
  • Game Console Controller (Target 3)
  • SSD and USB Adapter
  • Breadboard, Logic Level Shfter, Jumper Wires
  • Multimeter
  • Logic Analyzer
  • SOP8 Clip (For flash extraction)
  • SPI EEPROM, I2C EEPROM

Cinque Terre

Requirements

This course is targeted towards security researchers who want to learn more about the process of firmware extraction and embedded systems analysis. Students should be familiar with the Linux command line, and be comfortable with a scripting language such as python. C experience is also useful but not required

Interfacing with the Raspberry Pi requires an available USB port. A virtual machine is also provided to automate the configuration of the Raspberry Pi. Students should be able to load and run virtual machines if they are not comfortable installing Pulseview and configuring an ethernet interface on their host machine.

Private Offerings

This course can be offered privately (remote or onsite) for groups of eight or more students. If you are interested in a private offering of this course please contact us for more information.