start	end	text
0	6820	I'm just here to destroy. So, it's definitely a learning curve for me, where I'm just used to
6820	11540	breaking the thing down, just to break it down, versus breaking it down to actually get some
11540	17480	value out of it and turn it into something cool. So, yeah, I really appreciate all the support and
17480	24020	all the help so far. It's been a great journey. Outstanding, outstanding. So, we're getting close
24570	33680	kind of to the start point, just a minute or two out. Again, for those joining in the actual
35780	43920	Zoom webinar, there is a button down there where you can actually post questions. I encourage you
43920	51660	to please do so. The goal is, is we will try to answer any questions that come up.
51660	58340	If we have the answer. U-Boot's kind of an amazing topic, and none of us claim to be,
58340	63900	know possibly everything out there. But we'll do our best to be able to give you some good
63900	70640	feedback on your questions. Also, after this is all over, I'll be jumping over to Discord. I think
70640	77920	Garrett will be there also in the IoT Village Discord in the speaker area. So, if you have any
77920	87360	follow-up questions after that, please reach out to Garrett or me or Jonathan, and we'd be more
87360	95100	than glad to help you out. So, we're kind of at the go point. So, I'm going to turn this all over
95100	103900	to Garrett to go ahead and get started. So, it's all yours, Garrett. All right, right on. Well,
103900	109920	appreciate everyone taking some time out on Saturday. I know that normally we're in Vegas
109920	114740	right now. So, it would be no harm and no foul to be taking time out on a Saturday. But appreciate
114740	123600	y'all, you know, taking some time and tuning in today. So, without further ado, let's get this
123600	132200	party started. So, you should be able to see my screen. We're looking at the U-Boot DC28 IoT
132200	140100	Village is what we're going to be going over today. So, we got a couple agenda items to go
140100	144580	over real quick. You know, what is U-Boot? First off, we're going to get that out of the way.
144720	151040	Then we're going to go into pin glitching, a Philips Hue device, and then potentially getting
151040	156660	root on that machine. And then we're going to switch gears a little bit and go over some common
156660	163680	problems with Daryl Hyland. And it's common problems related to U-Boot and how U-Boot can
163680	171040	solve them. Then we're going to be rooting a Luma Wi-Fi access point. It's like a mesh Wi-Fi
171040	179980	device utilizing TFTP. And then following that, we're getting faded. So, that's the agenda for
179980	190220	the day. And without further ado, let's get this party rolling. So, what is U-Boot? So,
190220	196660	U-Boot is basically a universal bootloader. It's loaded by the system's ROM or read-only
197640	204200	memory or BIOS. And for many one of these supported devices like, you know, SD cards,
204200	213260	Flash, you know, using SPI or NAND Flash. And basically, it runs a command line interface
213260	220840	over a serial port. And, you know, people like us can load and boot a kernel, possibly changing any
220840	225160	of the parameters in there, you know, from the default to make it do what we want to do. Kind
225160	231080	of take over and give it our own instructions versus something that comes from the manufacturer.
231080	239120	You're also able to read device information, read and write Flash memory, you know, download files.
240120	247720	There's a lot of different things that you can do with this. And, you know, basically,
247720	255300	you can choose the memory locations of the kernel and other boot information and explicitly,
255300	259300	you know, tell it, hey, I want to look at this destination, and I'm going to copy this
259300	266700	information. So, it's really good at extracting data and pulling that out for further analysis,
266700	273220	you know, outside of that U-boot connection. So, it's loaded from Flash memory. It's often
273220	279760	accessible over a serial connection. And that's what we've used today is we're using a Chakra
281320	287680	utilizing UART to connect to these devices. It also comes with a limited set of commands. So,
287680	295800	several commands that we're going to be going over that come with U-boot. So, moving on.
297900	303700	So, ping glitch on the Philips Hue. So, that's what we're going to be doing first. I'm going
303700	309620	to get out of these slides. Boring, right? Let's get out of here. So, we're going to go up to
310540	314760	my other screen over here. And just to show you some of the devices
315540	320220	we're working with, we got the I'm looking all around me. It's right in front of me.
320920	326460	The Philips Hue. It's basically it's been stripped down. You know, I can see the underlying
327660	333760	form factor here. But, you know, this thing is to connect your lights in your house. So,
333760	337440	if you wanted to, you know, have a bunch of different colored lights and then control
337440	341300	them from your phone, you'd buy one of these devices. So, you can imagine a lot of people
341300	346000	have these in their houses. I think you can connect up to, like, 50 light bulbs with this
346000	352460	thing. And then we have the Luma, which is looks like a little Wi-Fi access point or something
352460	358240	like that. But it's exactly what it is. It's a mesh Wi-Fi access point. It's got Ethernet on board.
358240	363040	It's got a USB. It's got a bunch of other stuff in there you can't really see because
363040	368140	camera's not very clear. But that's what we're going to be breaking down today.
368140	373420	So, let me get my other situation going on here.
375800	380340	And first off, got to set this up. So, bear with me here.
381880	385720	And if you already have questions, you know, don't hesitate. Throw them out there while I get this
385720	397540	thing set up here. Okay, that's in there. Perfect. So, just get some wires out of the way. I should
397540	403860	remember that choice from last time. All good. So, just to break down what is on this now.
404220	412000	So, we have the UART connection over here to my Shikra using ground over here, receive and
412000	418560	transmit over here. So, we're connected to some headers that are on this motherboard. Then we have
418560	426160	another set of headers over here that's set up for my ground out wire. So, I have a wire that has a
426800	432780	paper clip shoved in the end of it that we may be using to glitch this thing out. So, that's a little
432780	439240	bit about what's on this thing. You also have the two flash chips that we're going to be looking at.
439240	445580	This one down here and this other rectangular guy right here. So, those are the two chips that are
445580	454120	communicating that we're going to be disrupting. So, on the left-hand side, I have a terminal
454120	460880	called... software called Cool Terminal. And it's free. You can download it. It's pretty
460880	464800	versatile on Mac from, you know, the few times that I've been using it here. And
465520	470280	so far, so good. You can actually see when it's transmitting and receiving. You can see when it's
470280	477280	connected. A lot of good detail here. So, I'm going to disconnect and I'm going to clear the data. And
477280	481600	I'm also going to look at these options. So, there has been some things that we did prior to this
481600	488080	call to kind of set this up for success. So, I did change the port to my USB serial because we are
488080	498080	using Ashikra. I did change the baud rate to 115200. And I also changed some of the terminal
498080	502960	settings so that we can actually interact with this terminal and not pull our hair out because
502960	508000	you can't backspace, you can't delete, and things start getting crazy. You know, if I can't go
508000	514620	backwards, then how can we go forwards? So, a few of the options I just wanted to highlight.
515600	521000	So, now that that's all said and done, let's get some power to this thing. So,
522180	526760	you can't see it, but I have a power strip with my,
526760	532700	controlled by my foot over here. So, let me just get power to this real quick.
534960	542430	Okay, so we got power there. Got to take my shoe off because I can't do it with my shoe. I totally
542430	548250	forgot I have to use my toe. So, all good. We're going to connect to this thing once we get some
548250	557250	power on it. And we're in. So, this is just the normal boot up of this device. We're just looking
557250	564750	at it from a terminal perspective. And with this, we can already get some good information,
564750	569750	good value, because we all know when things boot up, there's a lot of information that's kind of
569750	575710	sprayed out there. And sometimes it's machine communication, sometimes it's detailed information
575710	583270	that we can actually use and take back and, you know, learn more about this system. So, you know,
583270	587950	as it boots up, I think it takes about 32 seconds. So, we're almost there. This is a seconds
587950	596730	timer on the left-hand side, if that wasn't clear. So, once we get to the login, I think it's...
597710	603850	So, we're here. So, here's the login prompt. I don't know the password. I tried to look it up
603850	615190	and I didn't find it. Let's see. Roots admin. Just try one. All right. So, it's not working.
615210	622330	Okay. So, we cannot log in at this stage. So, let's take it to the motherboard, right? So,
622330	628250	I'm going to clear this out. Okay. So, we're going to start fresh. I'm going to turn the power on
628250	638930	this guy. My trusty index toe. There it is. So, I'm going to clear it. And let me get my wire ready.
639890	645510	Hopefully get this on the first shot here. So, clear the data. We're connected.
647490	656470	Power is on. And that's the pin. Oh, I'm shaking. Oh, there it is. Perfect.
656470	663630	So, we got the command line. So, if you didn't see it, it was pretty quick. But there is a pin
663630	672130	that I just lightly touched and pressed against this little paper clip thing right in there. So,
672130	678730	if I can keep my hand steady, it's right around there. So, that is what got us to this point.
678750	686330	And what can we do here? So, a few things. We can just ask for help. I mean, where are we? Help me.
686810	694090	So, we get a lot of different commands. You know, there's boot commands. There's
694090	701650	echo commands. We can echo arguments to the console. We can loop, infinite loop on an address
701650	707630	range. We can ping. I think there's a ping option in here. Yeah, ping. So, we can even try to
707630	713790	connect to other network assets, you know, that may be able to communicate to this device if we
713790	720890	want to. We can print the environment variables. We can set the environment variables, save the
720890	727510	environment variables. So, we have a lot of options here. We can even boot, TFTP boot if we wanted to.
727770	733750	So, a lot of different things we can see at this point. So, we're just going to print
733750	740210	the environment variables and see what else is in here. So, these environment variables
741090	748010	are somewhat of the command and control area of this device. So, what we change in here does affect
748010	755630	the entire system and the device. So, you know, we can see the baud rate there is set to 115200,
755630	761410	which is how we're able to communicate. We see some more flash boot up details with the kernel.
762090	769550	We also see some... what else is in here? We got some version information,
770630	775490	production information. Oh, we got an IP address. So, we got some IP information. We got a server
775490	781290	IP information. A lot of information in here. Boot delay. Oh, that looks good.
781810	787570	Oh, some security thing with a hash. That's probably something. Let's see. So, I'm gonna
787570	792870	just... so, we don't have to do that ping glitch again. I'm just gonna set the boot delay right now
792870	798430	because I don't know about you, but my head got shaky hands and I don't want to have to do that
798430	801850	every single time I reboot this thing. So, we're gonna set the environment variable
802510	807650	for boot delay to five seconds just to make sure that that held. We're gonna check it again
808970	813790	and it's there. So, we got five seconds on that boot delay. We have to save it.
813790	817770	Otherwise, it just goes away. So, we're gonna save this.
819290	824070	And that's all the jibber-jabber of saving that environment. Let's just print it one more time
824070	834680	for safekeeping. And boot delay is five. So, we are there. So, I'm just gonna reset.
835820	840400	Let this thing boot up again, except this time we should see a boot delay.
842020	850920	Ah, there it is. So, I am going to interrupt. Rude, right? So, now that we're back in,
850920	855280	what else can we do with this thing? So, let's take a look around back in those environment
855280	861820	variables. And the one that kind of jumped out to me was the security and this weird hash
861820	868700	following it. 1984, maybe there's some type of underlying message in here, but the security
868700	874520	is something we can mess with. So, let's just set the environment of security
876080	883240	to nothing. And nothing can be just two single ticks. Okay. So, if I save that or set that,
883240	894160	let's check it. Ah, security equals nothing. Perfect. So, we do need to make sure we save this,
894160	898690	save environment. No matter what, you always have to save. So, make sure that that's
899050	907190	a, you know, nailed down. And we'll just try resetting. See if that did anything for us. So,
907190	913550	essentially, what the manufacturer did with this is they hard-coded the password
914210	922270	into the device. Not a good idea, in my opinion. But that's what they did. And that's why we're
922270	927930	able to mess with it right now. So, we did let it go past the boot delay because we want to see
927930	933130	what happens when it actually boots up now. Because before, we got hit with a login prompt.
933310	939050	And I didn't have the password. So, we couldn't get anywhere with that. So, as this thing kind
939050	946330	of boots up, same kind of song and dance with the boot up information. You know, it's writing,
946330	951270	it's opening, it's loading, it's doing all these things. And any of those environments that we've
951270	959290	changed may affect, you know, this time right now. So, if we just wait a few more seconds,
959290	969290	the magic of television. And we are root. So, just by eliminating that environment variable security,
969290	976310	it actually cleared out the password. And that was actually the password in a hash. So, removing it
976310	982350	gave us root access. So, right on. High fives, air fives, you know, because the timing. But
983030	989190	air fives all around. We got this thing. So, what can we do now? Well, lots of things.
989410	996170	We can start looking at the mounted drives. We can dig into the root file system. We can look
996170	1002630	at the kernel. A bunch of different root drives in here. The root file system data drive. Maybe
1002630	1010910	there's some good detail in there. You know, we're clearly at the helm here. We clearly have
1010910	1017570	the reins of this device now. You know, we can look at other information on this thing and see
1017570	1023750	if there's more details that we can pull out of it. More user details. Maybe some hashes. Who knows?
1024310	1034470	But we are in like Flynn here. So, any questions on that so far?
1035450	1039650	Hey, Garrett. Yeah, looks like we have a couple questions here cropping up. So,
1039650	1044950	Strikeout looks like he's trying to do possibly some U-boot bypass through glitching on a wise
1044950	1050190	came out door. And this individual is asking where did you actually put the paperclip out on the chip?
1050190	1051610	A data line?
1053990	1060410	Yes. So, that is a great question. It is a data line. And it's in between these two
1061030	1067750	flash chips on the... I don't know if I can get a better view of this thing. But
1069210	1072990	that's looking terrible. So, I can't... I don't have a micro...
1074870	1078330	I don't have a magnifier to get you a better view of this. But
1078330	1084930	basically, there is a pin in between the two chips that is sending data.
1086470	1093670	It's basically this pin right here. It's a little silver flat pin there. And if you look close on
1093670	1099290	the motherboard, you can see the tracks going between those chips. You can kind of see it,
1099290	1106660	but now it's all blurry, of course. Yeah, to kind of add to that, this is
1106660	1113960	real quick. Often, one of the best things to do is once you've identified the flash chips
1113960	1120600	that you're going to attempt this on, is to track down the data sheets on those.
1120600	1127000	And from the data sheets, in this particular case, I traced out the data zero line.
1127680	1135620	So, between those two chips, this particular glitch is a little easier timing-wise because
1136320	1144560	the smaller chip that's toward the bottom actually has U-boot on it. The other chip
1144560	1151440	has the kernel on it. So, the goal is to find the data line for the chip containing a kernel
1152040	1159920	and interrupt that by taking it to ground. And the attempt there is U-boot's loaded,
1159920	1164280	and before it has a chance to actually load the kernel or call the kernel,
1164280	1170460	you literally take one of those data lines to ground, causing it to
1170460	1175540	fail to read it, as Garrett was talking about and as he showed there.
1182970	1187270	One other question here, Garrett, that is cropping up. Individual asks,
1187270	1193530	what type of device are you using to interact with the device here via UART?
1193530	1199310	Are you using something like a Shikra? Yeah, let me show you. I can show you what
1199310	1209570	that is here. We got one right here to show you. So, let me kill out this thing real quick.
1212450	1217710	So, we're going to disconnect and pull this thing right out of my laptop for you.
1221300	1228920	Hold power. All right. So, to give you a better idea of what this thing is, it's basically just
1229060	1236960	a little USB with a chip attached to it with several different header connections on it.
1237300	1243960	It comes with a data sheet that kind of breaks down what these connectors are, but that's literally
1243960	1249980	all it is. It has three cables. I don't know where my camera is. It's got three cables, one for ground,
1249980	1256720	one for receive and transmit. So, that's how I'm connected directly to this device.
1256720	1265780	So, hopefully that helps. But you can pick these things up off the internet. I think they're
1266980	1272780	30 or 40 bucks. I can't remember how much they cost, but they're doable.
1273740	1275760	And there's some other devices out there like
1278440	1283760	Pirate. There's one called, I think, UART Pirate or something like that, or Pirate Bay. I can't
1283760	1288580	remember what the name of it is, but there's several tools out there that do the same,
1288580	1292100	essentially the same thing. This is just the one that we use today.
1294600	1298520	Cool. That's, I think, the last of the cute questions that we have here. Bus
1298520	1302200	Pirate, I think, was the word you're looking for. That's what it was, Bus Pirate.
1303860	1308380	Oh, man. Yep. I knew it was something to do with the pirates. Pirate would be pretty good too,
1308380	1316380	I like the ring to none. Right on. Cool. Well, let me, if that's all the questions,
1316380	1325220	let me just get back to the slides here and move on. So, now we're going to switch gears a little
1325220	1333420	bit. We're going to be going over some common problems with embedded devices and then using
1333420	1338720	U-boot to solve them. So, I'm going to switch gears and pass it over to my colleague, Darryl
1338720	1347220	Hyland, and take it away from there. Let me just stop my share. Thanks, Garrett. Let me go ahead
1347220	1358000	and share my screen. Hopefully, everyone can see my screen. So, kind of get back to
1359320	1367880	the actual hue. So, I went and configured this hue to kind of exhibit some of the common problem
1367880	1374860	that you will often encounter. And I know I've hit it two or three times working on IoT gear
1374860	1384480	in the last year or so. And I know Jonathan has also encountered it. And again, this here is just
1384640	1392820	a standard hue. And then this here happens to be a quad UART device. I kind of like this one.
1392820	1397720	It's a little different than the Shikra. This one actually takes four different UARTs and you can
1397720	1404300	switch between three and a half and four volts. And it's all USB-based. So, it's kind of sweet.
1404300	1410200	I like using that if I need multiple UARTs at the same time. Sometimes... let's go ahead and
1410200	1416760	plug this device in. Make sure everything's going to come up here. So, again, often when you're
1416760	1422740	encountering devices, they'll come up. And if you noticed, it had the boot delay. I put the boot
1422740	1429460	delay on here just to avoid having the glitch again. But the ping glitch to force into a
1429460	1436040	U-Boot console is a literally very common method. But as you see, we hit a point here where it's
1436040	1444040	literally disabled. We no longer have a console. And this is not uncommon. You'll have a device
1444040	1455160	where you're actually able to establish a UART connection on the device and start seeing it
1455160	1460980	boot up. But then inevitably when it's booted up, there's literally no console whatsoever
1460980	1467760	on that device. I've had it go up to this point. You'll see console disabled. I've seen it come up
1467760	1473520	and not tell me console disabled, just say loading kernel. And then you see nothing after that.
1473520	1480320	So, whether you need to use a ping glitch or they've enabled the boot delay or some method
1480320	1485640	you can gain access to it, we're going to go ahead and go through that. And often,
1485640	1494220	the fix for this is typically very simple. Let's see if I can catch this here. Okay.
1496800	1504360	Actually, which is funny, that did not work for me. So, we'll see.
1505340	1509960	This is going to be funny if this doesn't work. It wouldn't surprise me if Zoom
1510920	1518220	caused the problem. Because, okay, we're able to get into it. So, back to those common commands
1518220	1523020	that Garrett had mentioned, like print environment. So, we're going to come over here and print
1523020	1529380	environment. And again, there's literally tons of environment variables. A lot of these environment
1529380	1535060	variables are part of the boot process, like Garrett said. Some of these actually pass commands
1535060	1542640	to the kernel. So, the kernel knows what to do as it's loaded up. And often, where you see
1542640	1549600	alterations that need to be made, the most common one is bootargs. You'll see bootargs
1549600	1556240	showing the configurations. But when we come over here, we see bootargs console is actually set
1556240	1561620	normal. So, maybe it's somewhere else. But here, we found out they have another environment variable
1561620	1568260	called standard bootargs. So, apparently, this is what's being called at some point.
1568700	1577440	Thus, we see the null taking place in here. Sometimes, this will involve very experimental.
1578060	1582700	First time, when I was setting this up to identify it, that's when I found out
1582700	1588320	that this bootargs segment doesn't work. And then you need to do it some other way.
1588320	1595380	And then turns out it was the standard bootargs. So, to go ahead and do this, again, like you did,
1595380	1609780	you go, you set the environment, which was standard std bootargs. Something always to remember also.
1611780	1616920	In this case, I'm going to rewrite the entire one. And we're going to set the console here.
1624280	1628960	And look at our standard bootargs. Make sure there's not another one. You would be surprised
1628960	1634100	how many times I've misspelled something. And it's easy to do. And what you end up doing
1634600	1639760	is just creating another argument that isn't read by the system or used.
1639980	1645400	So, then you boot the system. It goes, well, it didn't fix anything. What went wrong? Often,
1645400	1651080	it's just a typo. You've seen where people have made typos up here. Here's an example.
1651080	1658100	Security, security. That's kind of weird. So, again, that's probably a typo that took place
1658100	1663120	there. So, at this point, we'll go ahead and go save environment variables.
1664460	1669920	Write the environment variables back out. And then the reset command will cause the CPU to
1669920	1676720	reset on the device from the U-boot console. So, let's see if this will actually work.
1677600	1686320	And it's kind of amazing. Out of the number of times I've done this, more than
1687620	1692700	three quarters of the time when the device did boot up.
1694590	1703590	Oh, that's interesting. We seem to have a crash on the system. We had a kernel panic.
1704790	1717530	That's interesting. So, demos do go bad. So, we will see what we have here.
1719030	1724590	This doesn't come up. We're probably just going to move on. Typically,
1725770	1731430	you make these changes on the system. Yep, we got another kernel panic. I'm going to take
1731430	1758290	one more check and see what corrupted. Yeah, that's correct.
1759750	1766750	So, we're not going to waste much time on this. And we're just going to move on. Typically,
1766750	1772610	there may be something in here. Sometimes these things go bad. But normally, just by fixing the
1772610	1777690	console setting, for some reason, my kernel's messed up. I'm not sure how that happened.
1777690	1781770	Maybe from constantly rebooting this thing over and over and over.
1782410	1785890	Maya finally said, hey, I'm not going to play anymore, corrupted something.
1786170	1793470	But typically, when you go into the uBoot console, and you've broke into it, and you have a device
1793470	1799230	that will not give you a console after boot up, a lot of times you can go in here and alter either
1799230	1805450	boot args or some other reference that's used for the boot arguments that tell the kernel what
1805450	1810690	console, what bauld rate, all those typical things, and set that, and it'll come up.
1810810	1814930	Usually, three quarters of the time, when I've encountered this on commercial gear,
1814930	1820210	where they've actually turned the console off trying to hide access, when I do allow it to
1820210	1827010	boot up, it's giving me root access from the very get-go versus giving me a password prompt.
1827070	1834130	It's giving me root access. So, again, the best way to do this is check the console settings,
1834130	1842650	make sure they're correct, make sure they haven't turned initialization off. I've seen this
1842650	1849250	messed with, which would cause weird things in killing consoles and stuff like that.
1849930	1855050	But typically, nine times out of ten, it's literally going to be the console setting.
1855050	1862190	If it's not set, often when you identify the processor that may be used in this case,
1862190	1870590	you can do a little Google reference and identify the most common TTY setting for that. A lot of
1870590	1877830	times it's in the data sheet and stuff like that, to identify how it is naming its primary console
1877830	1884950	TTY. So, often data sheets, a little Google on the device or the processor in case, to be able
1884950	1891270	to identify that, and that helps you to literally set the console where it actually needs to be.
1891270	1898470	Unfortunately, that demo failed, even though it's worked 40 times up until today. And I will
1898470	1904750	stop sharing and turn this over to Garrett, so he can attempt his next demo. Is there any
1904750	1911750	questions related to this particular failure? Let's see. It looks like there's a couple folks
1911750	1917370	that are helping to troubleshoot, and I saw one of the issues too, I think. I guess it looks like
1917370	1923110	bootargs was double set. Also, the board equals appeared to be missing. The bootargs, I think,
1923110	1927150	for sure, might have been one of them. The board equals might take a little troubleshooting, but
1927150	1931350	that's a couple questions, I guess, that came up. But another... Oh, yeah, got it right there. I see
1931350	1938870	it. Yep. Yeah. Good catch, guys. Yep. Often when you're cutting and pasting, it's very difficult
1938870	1945070	to do that. Since I didn't define the board, that obviously called it. So, good catch out there.
1945070	1952950	Yeah. Props to folks on Twitch as well as here in the panel as well that kind of caught that.
1952950	1958510	But there is a couple questions that did crop up. One individual asks, how often do you find
1959070	1966310	that IoT devices are actually using U-boot? Like, would you say about 75%, 50%?
1966890	1973970	I'd have to say it's still probably a little higher than 50% that I engage devices that U-boot
1973970	1982690	used. Now, if they're running the latest version of U-boot, this typical pin glitch will not work.
1983010	1989750	So, what happens is the newer version of U-boot that is out there, if anyone is actually using it,
1989750	1996210	is supposed to, when it can't learn, it can't load the kernel, will actually restart the U-boot
1996210	2002390	process. So, it'll just go into an infinite loop until it can load the kernel in that case there.
2002390	2007670	That's how they kind of started to fix this problem. I assure you there's probably attack
2007670	2013070	methods in that case with that to get around to it. But the best fix, what we always recommend
2013070	2020230	to most vendors on how do you solve the problem with U-boot being an issue is start using secure
2020230	2029750	boot. That actually answers the last question that I had here was, what's the best way of
2029750	2034130	overcoming some of these issues? And it sounds like secure boot's the best method for that.
2042870	2048570	Yeah, I would say secure boot is the best solution to these issues that we're running through today.
2051610	2056030	And I think we had another question just popped up here that we can kind of squeeze in before we
2056030	2059070	move on. Because there's one more demo, is that correct, Garrett?
2059310	2063750	Yeah, yeah, we still got one more. But yeah, more questions, the more the merrier.
2063750	2068490	Okay, yeah. So, Asher asks, do you know why sometimes the environment variables cannot be
2068490	2073490	modified even with root access to the U-boot console? This apparently has happened for this
2073490	2082230	individual. The only thing I can think of off the top of my head is that the manufacturer hard
2082230	2089490	set some of those environment variables to not allow change even at a root level. Or there's
2089490	2095090	just some underlying permissions that, you know, even though we may feel we're root, there may be
2095090	2101810	some hard coded just permission set there that we just can't get into. I don't know, maybe someone
2101810	2107550	else has more to speak on that. But that's just my initial gut feeling.
2109270	2114530	I'd have to agree with that. I actually had a device I was playing with the other day.
2114530	2121050	And there was probably a half dozen arguments in the environment variables that when I changed
2121050	2129830	them and saved them, they never saved nothing. So, U-boot's a funny beast. Everybody compiles
2129830	2135530	it differently. So, the amount of features, functions, capabilities, and how it works
2135530	2141510	is very configurable. And every vendor will compile it and use it different.
2141750	2149330	Also, I've seen some where boot args and all of those settings are not even used by the kernel.
2149730	2157130	That stuff is actually hard coded into some kernel configurations. So, alterations with boot
2157130	2164870	args don't actually work, which can be problematic too when you're trying to carry out
2165330	2174470	some level of tax. Based on that, I think what Garrett's going to demo here just shortly
2175070	2182010	will actually open up some other possible opportunities. If you're able to break in
2182670	2188430	to the U-boot console, some of the stuff he's going to show may be very helpful in
2189110	2200860	gaining a level of access into the system. Awesome. Any other questions out there, John?
2200860	2203740	I think we're kind of on the queue. I think we're good to go.
2203760	2212400	All right. Right on. Moving on. So, next, we're going to be going over the Luma.
2212400	2219100	The Luma is that mesh device that we were looking at. It's got a little bit more to it
2219100	2226340	on the motherboard itself. There's just a lot more going on. It has onboard Ethernet. It's
2226340	2232380	got a USB port. It's got several different places to connect wires. There's some headers.
2233300	2239160	A lot of stuff going on. I think it's got a built-in Wi-Fi chip on it, possibly. I'm not sure.
2239160	2245700	But a lot of stuff going on there. So, we're going to boot to root here real quick out of
2245700	2254820	these slides back into the live action. Here we go. So, now I got my Luma set up here, broken down,
2254820	2262540	ripped it apart. I've got my UART connection over here with my ground, my receive, and my transmit.
2262540	2268360	We're all good. I have my Ethernet actually plugged in because I'm just going direct line
2268360	2275200	to this thing. And then I also have a ground wire that you can't really see. But there is a ground
2275200	2283560	wire soldered onto the board over here. So, the way that I did get into this thing initially was
2283820	2290160	a pin glitch. And I'm not going to show that today. But if it's something you want to see,
2290160	2297060	I can demo it later if we have time. But basically, this particular chip right here is the chip that
2297060	2303380	we are compromising to break into this thing. And it's actually this pin right here, this data
2303380	2309640	pin right over here, the second one up. I don't know if you can even see that. But there's eight
2309640	2319120	pins around that square chip. And we're going to short the data line or the data pin on that thing.
2319120	2324040	So, that's how we would have got into this thing. But since we already did that, the magic of
2324040	2331240	television, we're just going to plug some power into this thing. Okay. We got power now. And a
2331240	2341400	little bit more slack in that line. The trusty toe. Come on, toe. There it is. And we're connected.
2341400	2348520	And there it goes. So, what's funny about Cool Term is you have these receive and transmit
2348520	2353200	lights going on in the bottom. So, we know that we're getting data in some way somehow.
2354320	2360000	And again, with the boot up process, a lot of information here. And obviously, we can all read
2360000	2363500	extremely fast. That's how we're able to read everything that's going down the screen.
2363900	2370260	No, probably not. There's ways to extract this if you wanted to. Kind of if you recorded this
2370260	2375340	and just played it back slow. And you could be taking like screenshots as it goes through.
2375340	2381900	There's plenty of ways to kind of extract everything that's going on here. This one actually
2381900	2387280	takes a little bit longer to boot up than the Hue. I think just because it has more functionality
2387280	2393480	to it. It's not just going to turn your lights blue or green or red or whatever the ambience for
2393480	2399600	the evening happens to be. This time, it's actually going to provide internet connection.
2399760	2405660	So, when people come over or you have parties, not so much anymore. But when we did,
2405660	2410260	you want to have everyone be able to have internet. We got to be staying up to date on our
2410800	2416560	socials. We got to be, you know, staying up to date on everything. So, internet is good.
2417340	2420600	So, we may not wait for this whole thing to boot up. I think it takes about
2421080	2427420	a couple minutes. And my patience is weak. So, as this thing kind of rounds the bend here,
2427420	2432020	it looks like it's doing stuff with Wi-Fi. Looks like some connections were going on,
2432020	2438500	some different channels. Let's just see what happens. Oh, okay. So, we got a login prompt.
2440260	2447760	We can try to log in. I don't know the password, though. Let's give it a shot anyway. Login
2447760	2454720	incorrect. So, no luck again. We're 0 for 2 there on trying to just log into these things.
2455460	2459460	So, what can we do? We're just going to power cycle this thing.
2461680	2470120	All right. So, clear. Clear. All right. Pinky toe in action. All right. So,
2470120	2476560	like I said before, the, you know, how the cooking shows do it, they don't cook that whole
2476560	2481160	turkey right in front of you. That would be crazy. But they have one already in the oven. So, that's
2481160	2486540	kind of what happened here is I pin glitched this thing prior to this call so that I did set this
2486540	2493020	boot delay so that I could break out of it and get in there and actually show you some stuff. So,
2493020	2497380	similar to before, print environment variables. We can just ask for help, though. Just see what's
2497380	2505280	different about the Luma versus the Hue. So, some slight differences. This one's not as long
2505280	2511800	as far as the list of items that we can do. So, just kind of piggybacking on that final
2511800	2516880	question before is, you know, U-Boot is configured differently on every device,
2516880	2524600	or essentially it can be. So, I was even reading up on this company called Emac. I think they do,
2526460	2530740	Skada devices. And the way that they configure U-Boot was completely different
2530740	2536380	than another person who configured U-Boot. Because when I was looking things up on this
2537780	2542860	stuff, I would find several different explanations. Like, well, wait a minute.
2542920	2547880	Is this even the same thing? Like, yeah, it is. It just can be completely configured,
2547880	2553020	you know, in several different ways. Or compiled, I guess is the right word to use.
2553020	2558420	So, if we look at some of these things, what jumps out to me is the boot arguments, the boot
2558420	2566500	IPQ, boot from a flash device, boot from memory, boot from a network connection using TFTP.
2568340	2576600	Spoiler alert, maybe. We got ping, so we can actually test ping connections. Print environment,
2576600	2580420	like we already know. Save environment, set environment, that's all there.
2581480	2589300	Print the memory flash information. There's a TFTP boot command right there.
2589380	2593800	Oh, and a USB boot. So, a lot of stuff. This thing has a USB onboard, so,
2593800	2602180	you know, there's more opportunities here. So, today, let's get back into the print environment.
2602180	2607340	Let's take a look back at this. Today, we already have set the boot delay.
2607340	2614500	That's already done. Boot delay is set. This boot command, though, is set to that boot IPQ.
2614500	2620220	And if you don't remember, we can just quickly look back at that boot IPQ. What the heck is that?
2621360	2628280	So, here it is. Boot IPQ. And it's to boot from flash device. So, that's what it's set out of
2628280	2633380	the box from the manufacturer there. So, if we get back into those environment variables,
2633380	2641200	what else can we mess with? Let's see. So, IP address. Ah, IP address is important.
2641220	2649060	And we also have server IP. So, what can we do with those? So, basically, this IP address,
2649060	2655520	this Luma device does not have networking configured out of the box. So, when it turns on,
2655520	2662720	it just has a random IP in there. And I just set it to an available IP on the network that
2662720	2669000	isn't already being used by the Xbox or the PlayStation or the 10 Raspberry Pis or the
2669720	2674640	N64. You know what I'm saying? All these devices out here. So, I just chose a random IP. Doesn't
2674640	2684000	really matter. What does matter is the server IP. The server IP is going to be the TFTP server.
2684460	2690900	So, we're gonna be using TFTP to boot this thing or to boot from TFTP.
2690900	2700300	And that's where this extra server comes into play. So, I got my just a Ubuntu 16.04,
2700300	2706160	just fresh ISO I just pulled down the other day. And just found a couple articles online
2706160	2711340	on how to set up a TFTP server. It's really straightforward. You know, if I can do it,
2711340	2716700	I'm sure anybody on the call can do it. Because it's just creating a file, setting the right
2716700	2721980	parameters in that file, and then making sure the service is up and running. I can't tell you
2721980	2728060	how much pain I was having literally yesterday about trying to get this thing to work. And
2728060	2731840	literally, I didn't really change much. And it just started working again. So,
2731840	2738660	we're gonna see how well today goes. But anyway, it looks like it's up and running. We can just
2738660	2744780	see if this is still good to go. All the passwords, super secret. All right. So,
2744780	2752160	we're still running as of 1529. So, right on schedule there. Cool. And if we look at the IP
2752160	2762620	of this device, that might help, right? I have config. Let's see. So, this is 192.168.118. So,
2762620	2769880	that's where that IP comes into play. All right. Cool. So, jumping back to this now.
2770560	2779680	So, this boot command is set to this. We can actually override this particular boot command
2779680	2785940	here. And these boot arguments. Sorry, there might be a neighbor calling for their cat.
2785940	2791600	So, I've actually already gone ahead and wrote out this command just for sake of
2791600	2796000	typoing this thing a million times. I'm just gonna copy it over.
2798460	2803460	And if you notice, I didn't show it, actually. But if I go back to my VM,
2803460	2813540	I have a kernel image over here that has been compiled using open WRT. So, it's this is the
2813540	2819520	package or the image that we're gonna be calling from my TFTP server. So, I just dropped it on the
2820260	2825900	desktop here. I have it in several locations just because I was testing. So, I think it just needs
2825900	2835300	to be on the root drive, just accessible. So, good stuff there. And now that we're back here,
2835300	2844150	I'm just gonna paste this command. Cool. Just like that. So, I'm using TFTP boot,
2844850	2849710	which is one of those help arguments, if you remember. There was a TFTP boot argument that
2849710	2854970	we could use. And then I'm telling it, which piece of memory do I want to boot from? And I
2854970	2861310	want to boot this particular image. And then boot at this particular address in memory. So,
2861310	2866310	that's what this command is meant to do. So, without further ado, let's see how it goes.
2866310	2874950	Let's just hit the big red button. And right away, you can see that it's using an Ethernet device,
2874950	2884910	eth0. So, it is connected. It's from the server, my TFTP server at 1.18. And then from our address,
2885810	2891510	.25. So, looks like we might be in good shape here on the first go around. How about that?
2892450	2897050	Looks like it's uncompressing the kernel image. It's booting it up. You can see the OpenWrt right
2897050	2903930	here, if you catch it. And then it's off to the races. So, as this thing kind of boots up,
2903930	2911010	we'll see if we got any further than that login prompt that we had before. And if you're not
2911010	2918390	familiar with OpenWrt, it is open source. And those can also be kind of compiled a little bit
2918390	2926470	differently depending on, you know, what you want to do with it. So, by the way, the devices,
2926470	2932970	if you wanted to buy these devices, very cheap on eBay. You can pick them up here. Very cheap.
2932970	2940410	Just search eBay. But this OpenWrt, it's basically just an open source project that you can compile
2941050	2948630	different, you know, different things and connect to different devices. It's just fully customizable.
2949330	2952290	So, that's a little bit about what's going on there.
2954370	2960290	Let's see. So, as this thing kind of boots up, see if we just hit one of these random buttons
2960290	2969830	over here. Boom. So, that did it. We are in a built-in shell on the Luma device. So, this
2969830	2976430	technically is not the Luma OS. So, I want to be clear on that. We didn't just
2976430	2984270	root the whole Luma device. What we did is we created a kind of a landing place for
2985490	2991910	kind of like before the OS hits the ground, we created our own OS and said, hey, we want to
2991910	2999210	boot to our OS before you even get to yours. Okay? So, that's what this is. And so, it's not the
2999210	3006130	direct file system on the Luma. But we can still do things similar to the Hue where we can, you
3006130	3010490	know, dig into the root file system. We can look at the kernel, the firmware. There's a lot of
3010490	3016610	things that we can potentially get into. There's several different techniques to do that. One of
3016610	3023470	them would be mounting these drives. So, assuming that we had full permission, then we would just
3023470	3030110	mount these drives and start extracting data from there. If we don't, you know, in a situation where
3030110	3035510	we don't have access, say like for right now, like we have all zeros here. So, it's possible that we
3035510	3043690	don't have access to this right now. So, what we could do is use something like DD to extract the
3043690	3050910	data that way. It's a command line tool or something like TFTP and just siphon the data to
3050910	3058590	another medium and then perform, you know, additional analysis there. But as far as from
3058590	3063130	where we are right here, there are some things that we can do. But it is kind of in this open
3063130	3069750	WRT console now where we'd have to get a little bit creative and kind of use our noggins and
3071130	3075170	find another path to the Luma OS. But it's possible.
3076510	3082630	So, that's a little bit about what we got going on on this thing. We wanted to show, you know,
3082630	3091070	booting to an OS that we compiled on the device itself. So, that's a little bit about what we got
3091070	3096810	going on here. Any questions on how we got to this point?
3099650	3107970	Yep. A couple questions here. Let me take a look. One individual asks, I assume all of these attacks
3107970	3114610	require physical access. There's no way of performing this attack remotely. Is that correct?
3115470	3121370	Yes. So, unfortunately, if you did want to, you know, start doing some war driving or something
3121370	3127090	or mess with your family members, whatever, it's all ethical, right? You know, you would
3127090	3133090	have to have physical access to these devices. I imagine you could get physical access one time
3133090	3139230	and then set up some type of logic bomb or some type of, you know, hook into the device so that
3139230	3145370	if it were online, it could call to us in some way or somehow. Probably some of the devices that have
3145370	3155710	internet connection more so than not. But I know that I have the light bulbs from Costco. I think
3155710	3162450	they're called... oh, man, now I'm drawing a blank on it. But it's basically the same thing as the
3162450	3168490	Philips Hue. And it's the Costco version. I can't remember the name of it now. It's driving me nuts.
3168490	3175390	But basically, they were on the internet, and they didn't have very much any security. And
3175950	3185690	I was just afraid to even mess with it at that point. I'm like,
3185690	3194530	physical access to this thing. But, you know, you never know. So, good question.
3196250	3204130	All right. Taking a look at another question here. As far as... I think this was touched on a little
3204130	3209990	bit earlier as well by Daryl. But how do you know which pin to take to ground when glitching?
3209990	3216090	I know earlier we were talking about data zero, data one. But as far as testing is concerned,
3216090	3221070	how would you know about taking which pin to ground whenever you're performing this type of
3221070	3228090	glitching? Yeah, that's a good question. I do have the breakdown of that flash chip
3228090	3234910	on another screen somewhere, somehow. Bear with me. Can you still see my screen? Is it still
3234910	3242950	showing questions? Yes. Okay, give me one second and I can get that readout for you.
3242990	3252110	But basically, it is a data line, and it is the one that we would want to break into. So,
3252110	3259030	when you look at the data sheets for these devices, you do want to look for the data lines
3259030	3266050	is kind of the idea in finding out where those actually exist. Let's see if I can't
3267550	3278770	get a good shot of this. Give me one second. Okay, got that now. Let's just minimize some things.
3280890	3287250	Okay. So, see if I can't get a better view of this device here.
3290200	3296460	Okay. So, you can still see my screen. What I have on there now is basically the top down view
3296460	3304840	of that exact chip. So, if I look back to the camera, this is the chip breakdown, this one
3304840	3310220	right here. I don't know if you can see that, but the one with the little orange paint drop.
3311060	3317660	So, that's what we're breaking down in this diagram here. If I can get my pen out. There we
3317660	3326480	go. So, the line that we're shorting is this SO line. This SO line over here, that's the
3327240	3332720	data line. I can't remember exactly what it stands for. Maybe Daryl remembers, but
3334400	3339360	that's essentially what we're shorting in this example.
3343530	3347610	Yeah, exactly. There's also an interesting question that came up. When glitching,
3347610	3354390	would it be a little safer to use a resistor in lieu of a paper clip? There's a possibility you
3354390	3360830	could short a 3.3 or 5 volt trace pin and burn a register. Yeah, there's always a chance.
3362650	3369470	That's why it's very important to... I'm not against using a resistor. I mean, there is some
3369470	3377330	value to that. If you'd have to experiment around, because obviously you want to interrupt the
3377610	3384550	data significantly enough, and a resistor may or may not drop the voltage enough based on the
3384550	3391010	resistor size. But in reference to doing that, again, like he's showing here, go ahead and get
3391010	3396790	the data sheets, figure out what you're grounding out. So, literally, you don't like just smoke
3396790	3402770	something. To randomly go into a device here and go, oh, I think I'll just start grounding stuff
3402770	3410370	out. It's almost a guarantee that you will brick the device permanently. Now, I've had on these
3410370	3421270	glitching attacks, probably successful. Anytime there's two chips used, where U-Boot is on one
3421270	3427290	chip and the kernel file system is on another, I've had a hundred percent success every time
3427290	3434850	in actually doing that. I've only had a problem on one device, and it was using... I can't remember
3434850	3440330	the chip it was using. It was very much more high speed, so getting it at the right time was
3440330	3446450	difficult. We never destroyed the chip, but during the attack, even though I was taking the data line
3446450	3456670	down the ground, I ended up actually causing it to screw the U-Boot up, and it actually damaged
3456670	3465450	the U-Boot so that the chip would not boot up anymore. It would come up actually giving you an
3465450	3470270	error in the U-Boot. Now, how it altered part of the data in the U-Boot during this process,
3470270	3477750	I have no clue. Maybe it did fry register in there or smoke something, but we were able to
3477750	3482270	pull the chip and then successfully pull the entire operating system off and recover it all anyway, so
3484210	3485390	problem solved.
3487730	3496990	Yeah, and just to speak on that note too, I've definitely broken enough devices just tinkering
3496990	3501610	just like that and not really looking, you know, doing the right diligence of looking at the data
3501610	3506450	sheet, looking at what am I actually messing with. It was more like, it's how it works in the movies,
3506450	3509710	so it's how it works in real life. You know, I'm just going to touch a bunch of stuff and
3509710	3513950	now I'm in. So, I definitely have a bunch of devices that
3514850	3519070	just are paperweights around, scattered around.
3521090	3523790	Yeah, that's funny, dude.
3526750	3535950	Good stuff. So, that is getting into the Luma and being able to boot up,
3535950	3541190	another operating system such as OpenWrt.
3543210	3550210	So, if those devices aren't readily available to you, like the Philips Hue and the Luma,
3550210	3554830	things like this, or they're the ones that you use in your house and you're not trying to lose
3554830	3559810	internet in your house, totally get that. But if you have a Pi laying around, you can do the
3559810	3569530	exercise with a Raspberry Pi. There's several articles over the internet that you can find
3570050	3576390	how to do this, how to set it up, what you can do with it, and it's pretty wide. So,
3576390	3581490	this is just an example of a Raspberry Pi that we had connected, one of my colleagues set up
3581490	3587410	for me for this demo. So, then you have Uboot going on on the right-hand side. It's doing the
3587410	3595670	same kind of song and dance of getting into the flash memory, the kernel, and actually printing
3595670	3600850	the environment variables so that we can tweak them and adjust them and then tell it what we
3600850	3613610	wanted to do. So, it's just another example of a Raspberry Pi. Cool. So, that is all, folks. I
3613610	3618710	really appreciate everyone who was able to join this session on a Saturday when we're not in
3618710	3625110	Vegas. I'm assuming we're not in Vegas, but normally hungover at this time of the day and,
3625110	3633310	you know, completely, you know, con funk is in full force. You know, I don't know what time it
3633310	3639930	is. I don't know where I am. That's normally the status of this day for me. So, it's a little bit
3639930	3645150	different doing this thing virtual. So, I appreciate everyone who was able to join and
3645150	3652130	all the questions and, you know, really happy to be here. So, if you have any other questions,
3652130	3657950	throw them out there. But that's the end of the show. Yeah, there was one more question I saw
3657950	3664290	come in in the chat. It said, did you download someone else's build for the Luma or did you
3664290	3672570	do it yourself? In this particular case, this build was... I actually built this a while back
3672570	3683110	while I was doing some testing on the Luma. So, I used OpenWrt's program. This is built off an
3683110	3690090	IPQ40 series processors, which is what the processor is on that particular Luma. And it's
3690090	3697770	one of the chipsets that's actually supported within the OpenWrt. Now, in this particular case,
3697770	3704770	the success of this wasn't 100%, as Garrett pointed out, that the root FS was showing
3705590	3711270	nothing there or zero location. And the reason why that is, is because, remember, this is a
3711270	3718670	two-chip system. And when you're building an actual firmware package, you have to build out a
3718670	3731410	device tree. Now, most of all of the data available on OpenWrt was very well available
3731410	3738630	dealing with one-chip environments. But the device tree for the second chip
3738630	3747770	has not been built into this yet, which potentially made that an issue. But once you compile it
3747770	3753610	and compile it with the right complete device tree, complete it, then what he showed with PROC
3753610	3760690	MTD, which is the memory technology devices, kind of an abstract layer between the hardware,
3760690	3766770	the physical flash hardware, and the other part, you can literally from those potentially
3766770	3773250	mount those file systems up, or you can also DD them off by actually calling them directly
3773810	3782170	through dev MTD 0 through 9 or 10, which is one of the methods. It's really easy once you get some
3782170	3788250	kind of console, which would be the ultimate goal of bringing in a new kernel via TFTP, because you
3788250	3793690	would come in, it would have the device tree, you would see the chips, even though they're not
3793690	3799570	mounted up, you can easily DD all of those images off their file system, the root file system,
3799570	3807850	and everything from a separate booted kernel like this, giving you the ability to do some offline
3809390	3815970	binwalk and extract the data, hopefully find the root. Or inevitably, you could even,
3816610	3822610	when you find the root, you could easily in this particular case, DD it off, explode it out,
3822610	3829490	and then alter it, rebuild it, repack it back in, and then DD it back over that partition
3829490	3835270	area, and then reboot the device. And in that fashion, actually change the root password.
3835430	3841170	So this particular attack, as he addressed and talked about, will really open up a lot of new
3841170	3847830	avenues to some hardened devices. But it all comes down to, can you get access to that UBoot console?
3849070	3858530	And also, the presentation or the demo I ran, and the person pointed out where I missed board,
3858530	3861910	that was correct. As soon as we jumped off and he moved on, I went ahead,
3861910	3868070	fixed that typo, failed to copy and reboot it, and it came up to the root prompt. So
3868070	3873170	that worked out pretty good. So good shout out to that person, was able to visually,
3873170	3877890	quickly capture the idea that I missed that little piece. So totally cool.
3878910	3885170	Nice. Yeah, I just wanted to add on that. Sometimes on the devices, if you can still
3885170	3894510	see my screen, the prompt, the command prompts on the Luma is actually the name of the chip,
3894510	3901610	the IPQ40. So sometimes you can get even more details from just the device itself,
3901610	3907510	just telling you like, hey, this is what I am. Hope this helps, you know. But yeah,
3907510	3911930	I just wanted to call that out. I didn't mention it earlier, but IPQ40, like what the heck is that?
3911930	3918230	It's the name, it's the type of chipset that's on this thing, type of processor. So
3919750	3924910	cool. Well, really appreciate everyone, if that's all the questions.
3926510	3932290	Not sure if there's any more, but we're good to go, right on time.
3932710	3935850	Yeah, Jonathan, do you see anything else in the Twitch we might have missed?
3936730	3941030	I'm taking a look here. I do see that in Zoom, someone asks, it looks like it identified the
3941030	3947050	attached flash as well. So I guess from the U-Boot output there, it identifies the flash.
3947490	3951150	Pulling up Twitch, I think from Twitch, we're also good to go. So the last question, I guess,
3951150	3958210	was there and the question was, it looks like it identified the type of flash. And that might be
3958210	3965350	kind of equally a statement as it is a question. It did. It identified the one of the flash chips.
3968170	3976270	So could you actually from that booted kernel potentially get to those current chips?
3976270	3983910	Yeah, it's highly possible. You may have to do some manipulation. I haven't tried it yet.
3983910	3991310	But typically, the easiest way is to build it into the device tree for the kernel that you're
3991310	3996230	building for that processor. That's the most effective way. Once that's built in there,
3996230	4003390	it makes it 10 times easier for gaining access and basically altering this data or extracting
4003390	4011650	that data off there versus not necessarily have to figure out how do I access a chip when I don't
4011650	4022030	have a device tree for it. It's going to be very difficult. So yeah. Sorry, I had someone that was
4022030	4031930	playing the Linkin Park at the full capacity of the volume there. So I apologize as I drove by.
4032010	4037210	Okay, yeah, you have one person out there says you need to put that cowboy hat on behind you.
4037410	4040490	So you look like Billy Ray Cyrus.
4047010	4053670	Oh, y'all are cracking me up. Oh, man. I appreciate y'all. Yeah, let's see what we got.
4053950	4056650	Here we go. Hats on.
4057410	4063910	We have to take this off. But there we go. We're locked and loaded now.
4065570	4070030	Pretty great. This is how you find the real bones.
4073970	4075070	Nice.
4076730	4080910	I mean, the people in the audience, unless the presenters need to leave,
4080910	4090690	we still have time. There's no rush to close out quite yet. There's 30 minutes before next talk
4090690	4096210	comes on. So we still have just a little bit of time probably we could do another five minutes
4096210	4102690	if the presenters are still available. Hey, let me go ahead and let me go ahead and boot my
4102690	4114170	failure. So let's switch over to that. So let me go ahead and share my screen. Let's get that going.
4117290	4120170	Okay, hopefully everyone can see everything fine now.
4120830	4123830	So let's go ahead and power this. Watch this thing fail again.
4124770	4132770	I should know when to walk away to a demo failure. So let's go ahead and stop here real quick.
4132770	4140170	Let's go print environment. So we can see what I altered. So I altered standard boot.
4140430	4148030	When I copied it over, I missed this word right here, board equals. So it ended up specifying
4148030	4154390	this board. And what's kind of strange is often when you do boot args, and I've mistyped things
4154390	4159810	before, I'd never had it cause a kernel panic like that before. So it's kind of interesting.
4159810	4165750	I've had it just skip over that functionality or whatever. So that was kind of interesting.
4166210	4173090	So the change I did this originally said null, we're able to identify with a little legwork
4173090	4179110	watching the system normally boot up, looking at some of that stuff, identify the type of TTY
4179650	4207570	and replace the console null out of there. So it's common to see these options also on devices
4208230	4214570	that are outside of the U-boot where it says press F key, enter into failsafe mode. Sometimes
4214570	4220330	these will put you into a single user mode when the vendor's crazy enough to leave them available.
4220330	4225910	Something to think about from when you're watching a boot option, it's not part of the U-boot stuff,
4225910	4232430	but it can be very helpful. It will put you in a very locked down system. There won't be network,
4232430	4238890	there won't be device drivers, there won't be nothing on there. So inherently, there you go. So
4239450	4246530	instantly you're able to get past that. And like I said, this is kind of a common issue that you
4246530	4252770	can run into a number of times where they've just basically said, turn the console off before you
4252770	4259550	boot kernel or turn the console off when kernel, before kernel runs. And because of that, you don't
4259550	4266250	get a console. If you can gain access to U-boot, probably eight out of 10 times, you can change
4266250	4273410	those settings to be able to gain access to a console. Now, whether you'll have full root access
4273410	4281590	after boot is to be found or figured out. But believe it or not, I think over the last so many
4281590	4290430	years, I've encountered three or four devices that had it set up to go ahead and halt the console so
4290430	4295230	you can have it. And when I changed the argument so the console was enabled, at least half the time,
4295230	4303210	I had a full root console at that point. And these settings here that I mentioned,
4303210	4309150	the press one, two, just select the debug mode. Never had much luck with those. Sometimes they
4309150	4314610	do things, sometimes they don't. But the F key, if you ever see that, takes you to failsafe mode.
4314610	4320310	This will give you root level access, but it's amazing how complicated with root level access
4320310	4326890	and no ability to move data on or out of the device. It's doable, but it becomes very
4326890	4331810	problematic because often you actually have to build the device nodes. And if they harden the
4331810	4338210	device and turn certain programs off and remove them, it becomes more difficult. From the Luma,
4338210	4344250	just out of curiosity from the Luma, this had this and I was working to try to get data off of it.
4344250	4351050	In a way I originally did it was go into the F mode and actually build, manually build all the
4351050	4361350	device, not totally manually, but very close to manually reconstruct the device nodes, naming them
4361350	4367130	all the correct pieces and parts to build a USB. And then from there was able to move the data off
4367130	4374430	to the USB. Just some stuff to think about. A small question just came up, Daryl. I know
4374430	4379410	you had mentioned this yesterday during your building the IoT lab. What is your FTDI device
4379410	4384650	you're using for that one? Its name escapes me. Someone was asking on Twitch. Oh, gosh,
4384650	4389530	this one I have right here. Yeah, it was that cool one that could do like more than just it had like
4389530	4402240	it supported like SPI and others in addition to UART. Yeah, that's the one. Let's power this off.
4402320	4407760	Let's see if this has this name, has a name on it. I don't know if this even has a name. It's
4407760	4414700	very generic and I do not even have the box for it anymore. I bought this off Amazon. All I did
4414700	4424860	was search for multi UART connector or multi port UART connector and this came up. If I remember
4424860	4435500	the price of this was like twenty seven dollars. But to to the life of me, I do not know the name.
4435500	4443520	This is a generic build device coming out of China and it works pretty good. So
4444700	4452720	cool. But sadly, I do not know what its name is or who makes it. Gotcha. Another question
4452720	4459720	cropped up. Is there a URL or GitHub of some type where one could get ROMs to access a processor
4459720	4464420	or access to a processor to play around with and do this type of stuff?
4466420	4474420	I think they're asking, is there, I guess, any like I guess I think I think what's being asked
4474420	4480980	with it is are there maybe like a list of devices that that could be purchased in order to do things
4480980	4489260	such as U-Boot exploitation? I would actually literally exactly what Garrett said, go to
4491360	4500220	go on to eBay and look at buying some of the devices on eBay. I think would be bright. You
4500220	4507200	get the Lumos. You can get the you can go ahead and get the Hughes out there. He actually had
4507320	4512780	a screen where he was showing some that were available. They're not expensive. I'm not sure
4512780	4517320	how this would work. This is a product that that I was playing around with just recently,
4517320	4524880	and it's like 19 or 20 bucks. And basically, it has OpenWRT running on it right now.
4524880	4530640	It has serial connections. There's a flash chip so you can practice pulling the chip off if you
4530640	4537660	want reading it or using SPI chip reading techniques. You can probably trace out
4538360	4544080	versus some of these headers or connectors. You may be able to trace out the actual
4545540	4553660	JTAGs on this for the chip. It has Ethernet. It has Wi-Fi. It has USB. And literally, it's like
4553660	4561880	20 bucks. So this would be an easy, cheap device to possibly play with. And that's
4565840	4572840	Vixby 300 wireless travel router. I would try playing around with that. But I have to admit,
4572840	4581200	this was kind of footsy when it came to the actual U-boot arguments. I had a couple arguments
4581200	4586460	that didn't work, and I couldn't alter and stuff like that. Here's another device. I think it's
4586460	4592000	the exact same product. They're just white-labeled different. GL-iNet and Mini Smart Router also
4592980	4599840	has all the same functions and features on it. I'm not sure if the Mango is still on the market.
4599840	4608120	May be able to buy one used. But a lot of these cheap devices are out there,
4608120	4617500	and it gives you a chance to experiment with UART and JTAG and SPI chips and sometimes NAND chips
4617500	4625440	and flash chips. I mean, the list goes on and on and on, and they're often cheap. Like I said,
4625440	4631620	Luma I like a lot because it has all of those same features, and you can get them for 20-30
4631620	4641340	bucks used. It has the USB. It has the Ethernet. It has UART connectivity. It has NAND flash chips
4641340	4651040	on the device. It has SOIC8 SPI flash memory chips on the device. So it's a perfect platform
4651600	4657940	for hacking, attacking, experimenting. The pin glitch works on it also as an example.
4662610	4669390	Awesome. I was just catching up in the chat. It was a F-E-I-T, however you pronounce that. It
4669390	4675310	was a fight bulb that I had from Costco that I just decided to put and leave in the drawer because
4676290	4678770	just didn't feel very secure about it.