WEBVTT

00:00.000 --> 00:01.540
I'm just here to destroy.

00:01.700 --> 00:13.980
So, it's definitely a learning curve for me, where I'm just used to breaking the thing down, just to break it down, versus breaking it down to actually get some value out of it and turn it into something cool.

00:13.980 --> 00:18.800
So, yeah, I really appreciate all the support and all the help so far.

00:18.800 --> 00:20.240
It's been a great journey.

00:21.160 --> 00:22.440
Outstanding, outstanding.

00:22.440 --> 00:28.940
So, we're getting close kind of to the start point, just a minute or two out.

00:29.340 --> 00:42.160
Again, for those joining in the actual Zoom webinar, there is a button down there where you can actually post questions.

00:42.160 --> 00:46.360
I encourage you to please do so.

00:46.360 --> 00:51.660
The goal is, is we will try to answer any questions that come up.

00:51.660 --> 00:53.300
If we have the answer.

00:53.780 --> 01:00.740
U-Boot's kind of an amazing topic, and none of us claim to be, know possibly everything out there.

01:00.740 --> 01:05.960
But we'll do our best to be able to give you some good feedback on your questions.

01:05.960 --> 01:10.340
Also, after this is all over, I'll be jumping over to Discord.

01:10.340 --> 01:16.920
I think Garrett will be there also in the IoT Village Discord in the speaker area.

01:16.920 --> 01:29.260
So, if you have any follow-up questions after that, please reach out to Garrett or me or Jonathan, and we'd be more than glad to help you out.

01:29.260 --> 01:31.980
So, we're kind of at the go point.

01:31.980 --> 01:38.140
So, I'm going to turn this all over to Garrett to go ahead and get started.

01:38.140 --> 01:39.700
So, it's all yours, Garrett.

01:41.040 --> 01:43.180
All right, right on.

01:43.600 --> 01:47.820
Well, appreciate everyone taking some time out on Saturday.

01:47.820 --> 01:50.620
I know that normally we're in Vegas right now.

01:50.620 --> 01:54.160
So, it would be no harm and no foul to be taking time out on a Saturday.

01:54.160 --> 02:00.240
But appreciate y'all, you know, taking some time and tuning in today.

02:00.820 --> 02:04.980
So, without further ado, let's get this party started.

02:04.980 --> 02:07.040
So, you should be able to see my screen.

02:07.740 --> 02:14.840
We're looking at the U-Boot DC28 IoT Village is what we're going to be going over today.

02:17.120 --> 02:21.300
So, we got a couple agenda items to go over real quick.

02:21.300 --> 02:22.500
You know, what is U-Boot?

02:22.520 --> 02:24.580
First off, we're going to get that out of the way.

02:24.720 --> 02:32.420
Then we're going to go into pin glitching, a Philips Hue device, and then potentially getting root on that machine.

02:32.780 --> 02:39.800
And then we're going to switch gears a little bit and go over some common problems with Daryl Hyland.

02:39.940 --> 02:44.860
And it's common problems related to U-Boot and how U-Boot can solve them.

02:44.900 --> 02:49.400
Then we're going to be rooting a Luma Wi-Fi access point.

02:49.400 --> 02:54.800
It's like a mesh Wi-Fi device utilizing TFTP.

02:55.020 --> 02:58.160
And then following that, we're getting faded.

02:58.400 --> 03:00.980
So, that's the agenda for the day.

03:01.660 --> 03:05.600
And without further ado, let's get this party rolling.

03:05.600 --> 03:09.620
So, what is U-Boot?

03:09.620 --> 03:13.780
So, U-Boot is basically a universal bootloader.

03:13.880 --> 03:19.940
It's loaded by the system's ROM or read-only memory or BIOS.

03:19.940 --> 03:28.960
And for many one of these supported devices like, you know, SD cards, Flash, you know, using SPI or NAND Flash.

03:30.040 --> 03:35.260
And basically, it runs a command line interface over a serial port.

03:35.680 --> 03:45.020
And, you know, people like us can load and boot a kernel, possibly changing any of the parameters in there, you know, from the default to make it do what we want to do.

03:45.020 --> 03:51.080
Kind of take over and give it our own instructions versus something that comes from the manufacturer.

03:51.080 --> 03:59.120
You're also able to read device information, read and write Flash memory, you know, download files.

04:00.120 --> 04:03.400
There's a lot of different things that you can do with this.

04:04.220 --> 04:20.200
And, you know, basically, you can choose the memory locations of the kernel and other boot information and explicitly, you know, tell it, hey, I want to look at this destination, and I'm going to copy this information.

04:20.200 --> 04:30.360
So, it's really good at extracting data and pulling that out for further analysis, you know, outside of that U-boot connection.

04:30.680 --> 04:32.680
So, it's loaded from Flash memory.

04:32.680 --> 04:35.660
It's often accessible over a serial connection.

04:35.660 --> 04:44.460
And that's what we've used today is we're using a Chakra utilizing UART to connect to these devices.

04:44.780 --> 04:47.540
It also comes with a limited set of commands.

04:47.540 --> 04:52.580
So, several commands that we're going to be going over that come with U-boot.

04:53.620 --> 04:55.800
So, moving on.

04:57.900 --> 05:01.760
So, ping glitch on the Philips Hue.

05:01.760 --> 05:03.520
So, that's what we're going to be doing first.

05:03.520 --> 05:05.040
I'm going to get out of these slides.

05:06.200 --> 05:06.980
Boring, right?

05:06.980 --> 05:07.920
Let's get out of here.

05:07.920 --> 05:12.240
So, we're going to go up to my other screen over here.

05:12.380 --> 05:19.200
And just to show you some of the devices we're working with, we got the I'm looking all around me.

05:19.200 --> 05:20.220
It's right in front of me.

05:20.920 --> 05:22.260
The Philips Hue.

05:22.680 --> 05:24.960
It's basically it's been stripped down.

05:24.960 --> 05:28.820
You know, I can see the underlying form factor here.

05:28.820 --> 05:33.540
But, you know, this thing is to connect your lights in your house.

05:33.540 --> 05:39.920
So, if you wanted to, you know, have a bunch of different colored lights and then control them from your phone, you'd buy one of these devices.

05:39.920 --> 05:43.080
So, you can imagine a lot of people have these in their houses.

05:43.540 --> 05:46.600
I think you can connect up to, like, 50 light bulbs with this thing.

05:46.880 --> 05:52.940
And then we have the Luma, which is looks like a little Wi-Fi access point or something like that.

05:52.940 --> 05:54.520
But it's exactly what it is.

05:54.520 --> 05:56.680
It's a mesh Wi-Fi access point.

05:56.680 --> 05:58.240
It's got Ethernet on board.

05:58.240 --> 05:59.420
It's got a USB.

06:00.160 --> 06:04.580
It's got a bunch of other stuff in there you can't really see because camera's not very clear.

06:04.580 --> 06:08.140
But that's what we're going to be breaking down today.

06:08.140 --> 06:13.420
So, let me get my other situation going on here.

06:15.800 --> 06:18.880
And first off, got to set this up.

06:18.880 --> 06:20.340
So, bear with me here.

06:21.880 --> 06:24.360
And if you already have questions, you know, don't hesitate.

06:24.360 --> 06:28.320
Throw them out there while I get this thing set up here.

06:32.360 --> 06:33.620
Okay, that's in there.

06:33.620 --> 06:34.360
Perfect.

06:35.000 --> 06:37.280
So, just get some wires out of the way.

06:37.280 --> 06:39.320
I should remember that choice from last time.

06:39.320 --> 06:40.260
All good.

06:40.540 --> 06:43.860
So, just to break down what is on this now.

06:44.220 --> 06:52.920
So, we have the UART connection over here to my Shikra using ground over here, receive and transmit over here.

06:52.920 --> 06:57.240
So, we're connected to some headers that are on this motherboard.

06:57.500 --> 07:04.800
Then we have another set of headers over here that's set up for my ground out wire.

07:04.800 --> 07:11.800
So, I have a wire that has a paper clip shoved in the end of it that we may be using to glitch this thing out.

07:11.800 --> 07:14.100
So, that's a little bit about what's on this thing.

07:14.100 --> 07:19.240
You also have the two flash chips that we're going to be looking at.

07:19.240 --> 07:22.880
This one down here and this other rectangular guy right here.

07:22.880 --> 07:28.600
So, those are the two chips that are communicating that we're going to be disrupting.

07:29.280 --> 07:37.080
So, on the left-hand side, I have a terminal called... software called Cool Terminal.

07:37.640 --> 07:38.620
And it's free.

07:38.620 --> 07:39.880
You can download it.

07:40.100 --> 07:44.800
It's pretty versatile on Mac from, you know, the few times that I've been using it here.

07:44.800 --> 07:47.100
And so far, so good.

07:47.240 --> 07:49.700
You can actually see when it's transmitting and receiving.

07:49.700 --> 07:51.080
You can see when it's connected.

07:51.580 --> 07:52.960
A lot of good detail here.

07:52.960 --> 07:57.180
So, I'm going to disconnect and I'm going to clear the data.

07:57.180 --> 07:58.640
And I'm also going to look at these options.

07:58.640 --> 08:04.700
So, there has been some things that we did prior to this call to kind of set this up for success.

08:04.700 --> 08:09.520
So, I did change the port to my USB serial because we are using Ashikra.

08:09.580 --> 08:13.660
I did change the baud rate to 115200.

08:14.600 --> 08:27.400
And I also changed some of the terminal settings so that we can actually interact with this terminal and not pull our hair out because you can't backspace, you can't delete, and things start getting crazy.

08:27.400 --> 08:30.760
You know, if I can't go backwards, then how can we go forwards?

08:31.100 --> 08:34.620
So, a few of the options I just wanted to highlight.

08:35.600 --> 08:40.080
So, now that that's all said and done, let's get some power to this thing.

08:40.080 --> 08:48.960
So, you can't see it, but I have a power strip with my, controlled by my foot over here.

08:49.020 --> 08:52.700
So, let me just get power to this real quick.

08:54.960 --> 08:57.020
Okay, so we got power there.

08:59.450 --> 09:02.190
Got to take my shoe off because I can't do it with my shoe.

09:02.190 --> 09:04.090
I totally forgot I have to use my toe.

09:04.870 --> 09:06.330
So, all good.

09:06.330 --> 09:09.490
We're going to connect to this thing once we get some power on it.

09:11.790 --> 09:13.250
And we're in.

09:13.350 --> 09:16.690
So, this is just the normal boot up of this device.

09:16.690 --> 09:20.850
We're just looking at it from a terminal perspective.

09:21.550 --> 09:30.750
And with this, we can already get some good information, good value, because we all know when things boot up, there's a lot of information that's kind of sprayed out there.

09:30.750 --> 09:41.470
And sometimes it's machine communication, sometimes it's detailed information that we can actually use and take back and, you know, learn more about this system.

09:41.770 --> 09:46.050
So, you know, as it boots up, I think it takes about 32 seconds.

09:46.230 --> 09:47.150
So, we're almost there.

09:47.150 --> 09:52.250
This is a seconds timer on the left-hand side, if that wasn't clear.

09:53.510 --> 09:56.730
So, once we get to the login, I think it's...

09:57.710 --> 09:58.590
So, we're here.

09:58.590 --> 10:01.390
So, here's the login prompt.

10:01.390 --> 10:02.530
I don't know the password.

10:02.550 --> 10:06.350
I tried to look it up and I didn't find it.

10:06.910 --> 10:07.750
Let's see.

10:07.810 --> 10:09.870
Roots admin.

10:10.190 --> 10:11.590
Just try one.

10:12.790 --> 10:13.310
All right.

10:13.310 --> 10:15.190
So, it's not working.

10:15.210 --> 10:15.470
Okay.

10:15.470 --> 10:18.470
So, we cannot log in at this stage.

10:18.750 --> 10:21.910
So, let's take it to the motherboard, right?

10:21.990 --> 10:23.850
So, I'm going to clear this out.

10:25.650 --> 10:26.170
Okay.

10:26.170 --> 10:27.290
So, we're going to start fresh.

10:27.290 --> 10:29.270
I'm going to turn the power on this guy.

10:29.330 --> 10:32.510
My trusty index toe.

10:32.510 --> 10:33.770
There it is.

10:33.770 --> 10:35.390
So, I'm going to clear it.

10:35.930 --> 10:38.930
And let me get my wire ready.

10:39.890 --> 10:42.270
Hopefully get this on the first shot here.

10:42.270 --> 10:43.970
So, clear the data.

10:44.250 --> 10:45.510
We're connected.

10:47.490 --> 10:50.070
Power is on.

10:50.550 --> 10:52.790
And that's the pin.

10:52.910 --> 10:54.750
Oh, I'm shaking.

10:54.870 --> 10:55.750
Oh, there it is.

10:55.750 --> 10:56.470
Perfect.

10:56.470 --> 11:00.270
So, we got the command line.

11:00.750 --> 11:02.470
So, if you didn't see it, it was pretty quick.

11:02.470 --> 11:11.930
But there is a pin that I just lightly touched and pressed against this little paper clip thing right in there.

11:11.930 --> 11:15.170
So, if I can keep my hand steady, it's right around there.

11:15.170 --> 11:18.730
So, that is what got us to this point.

11:18.750 --> 11:20.110
And what can we do here?

11:20.290 --> 11:22.190
So, a few things.

11:22.290 --> 11:24.170
We can just ask for help.

11:24.170 --> 11:25.130
I mean, where are we?

11:25.170 --> 11:26.330
Help me.

11:26.810 --> 11:29.390
So, we get a lot of different commands.

11:30.810 --> 11:32.790
You know, there's boot commands.

11:33.650 --> 11:35.050
There's echo commands.

11:35.050 --> 11:37.310
We can echo arguments to the console.

11:37.310 --> 11:42.590
We can loop, infinite loop on an address range.

11:42.650 --> 11:44.190
We can ping.

11:44.290 --> 11:45.790
I think there's a ping option in here.

11:45.790 --> 11:46.630
Yeah, ping.

11:46.710 --> 11:54.630
So, we can even try to connect to other network assets, you know, that may be able to communicate to this device if we want to.

11:54.930 --> 11:58.330
We can print the environment variables.

11:58.570 --> 12:01.830
We can set the environment variables, save the environment variables.

12:01.830 --> 12:03.730
So, we have a lot of options here.

12:04.090 --> 12:07.510
We can even boot, TFTP boot if we wanted to.

12:07.770 --> 12:11.930
So, a lot of different things we can see at this point.

12:12.230 --> 12:17.350
So, we're just going to print the environment variables and see what else is in here.

12:17.350 --> 12:25.950
So, these environment variables are somewhat of the command and control area of this device.

12:25.950 --> 12:30.970
So, what we change in here does affect the entire system and the device.

12:31.550 --> 12:37.290
So, you know, we can see the baud rate there is set to 115200, which is how we're able to communicate.

12:37.770 --> 12:41.410
We see some more flash boot up details with the kernel.

12:42.090 --> 12:46.770
We also see some... what else is in here?

12:46.770 --> 12:51.610
We got some version information, production information.

12:51.610 --> 12:53.090
Oh, we got an IP address.

12:53.270 --> 12:54.930
So, we got some IP information.

12:54.930 --> 12:56.930
We got a server IP information.

12:57.530 --> 12:59.370
A lot of information in here.

12:59.370 --> 13:00.110
Boot delay.

13:00.110 --> 13:01.290
Oh, that looks good.

13:01.810 --> 13:04.030
Oh, some security thing with a hash.

13:04.030 --> 13:05.450
That's probably something.

13:06.210 --> 13:07.050
Let's see.

13:07.050 --> 13:10.290
So, I'm gonna just... so, we don't have to do that ping glitch again.

13:10.290 --> 13:20.210
I'm just gonna set the boot delay right now because I don't know about you, but my head got shaky hands and I don't want to have to do that every single time I reboot this thing.

13:20.210 --> 13:26.790
So, we're gonna set the environment variable for boot delay to five seconds just to make sure that that held.

13:26.790 --> 13:29.930
We're gonna check it again and it's there.

13:30.550 --> 13:32.570
So, we got five seconds on that boot delay.

13:32.570 --> 13:33.790
We have to save it.

13:33.790 --> 13:36.250
Otherwise, it just goes away.

13:36.250 --> 13:37.770
So, we're gonna save this.

13:39.290 --> 13:42.790
And that's all the jibber-jabber of saving that environment.

13:42.790 --> 13:45.410
Let's just print it one more time for safekeeping.

13:49.220 --> 13:50.740
And boot delay is five.

13:50.740 --> 13:51.980
So, we are there.

13:52.700 --> 13:54.680
So, I'm just gonna reset.

13:55.820 --> 14:00.400
Let this thing boot up again, except this time we should see a boot delay.

14:02.020 --> 14:03.480
Ah, there it is.

14:03.480 --> 14:05.960
So, I am going to interrupt.

14:06.680 --> 14:07.960
Rude, right?

14:08.080 --> 14:12.660
So, now that we're back in, what else can we do with this thing?

14:12.660 --> 14:16.200
So, let's take a look around back in those environment variables.

14:16.200 --> 14:23.380
And the one that kind of jumped out to me was the security and this weird hash following it.

14:24.720 --> 14:31.600
1984, maybe there's some type of underlying message in here, but the security is something we can mess with.

14:31.600 --> 14:37.340
So, let's just set the environment of security to nothing.

14:37.340 --> 14:39.760
And nothing can be just two single ticks.

14:40.300 --> 14:40.800
Okay.

14:41.080 --> 14:44.600
So, if I save that or set that, let's check it.

14:48.600 --> 14:50.460
Ah, security equals nothing.

14:50.460 --> 14:51.280
Perfect.

14:51.320 --> 14:55.260
So, we do need to make sure we save this, save environment.

14:55.540 --> 14:57.700
No matter what, you always have to save.

14:57.700 --> 15:01.770
So, make sure that that's a, you know, nailed down.

15:02.050 --> 15:04.190
And we'll just try resetting.

15:04.250 --> 15:05.770
See if that did anything for us.

15:05.770 --> 15:15.610
So, essentially, what the manufacturer did with this is they hard-coded the password into the device.

15:15.610 --> 15:18.130
Not a good idea, in my opinion.

15:18.730 --> 15:21.690
But that's what they did.

15:21.690 --> 15:24.650
And that's why we're able to mess with it right now.

15:24.930 --> 15:29.990
So, we did let it go past the boot delay because we want to see what happens when it actually boots up now.

15:29.990 --> 15:33.130
Because before, we got hit with a login prompt.

15:33.310 --> 15:34.650
And I didn't have the password.

15:34.650 --> 15:37.010
So, we couldn't get anywhere with that.

15:37.850 --> 15:43.490
So, as this thing kind of boots up, same kind of song and dance with the boot up information.

15:44.430 --> 15:48.970
You know, it's writing, it's opening, it's loading, it's doing all these things.

15:49.370 --> 15:56.090
And any of those environments that we've changed may affect, you know, this time right now.

15:56.310 --> 16:01.210
So, if we just wait a few more seconds, the magic of television.

16:02.050 --> 16:03.970
And we are root.

16:04.010 --> 16:11.550
So, just by eliminating that environment variable security, it actually cleared out the password.

16:11.550 --> 16:14.830
And that was actually the password in a hash.

16:14.830 --> 16:18.410
So, removing it gave us root access.

16:18.590 --> 16:19.190
So, right on.

16:19.190 --> 16:22.070
High fives, air fives, you know, because the timing.

16:22.170 --> 16:24.350
But air fives all around.

16:24.350 --> 16:25.550
We got this thing.

16:25.630 --> 16:27.310
So, what can we do now?

16:27.690 --> 16:29.190
Well, lots of things.

16:29.410 --> 16:32.790
We can start looking at the mounted drives.

16:33.390 --> 16:35.750
We can dig into the root file system.

16:35.750 --> 16:37.330
We can look at the kernel.

16:37.550 --> 16:39.570
A bunch of different root drives in here.

16:39.890 --> 16:42.470
The root file system data drive.

16:42.470 --> 16:44.450
Maybe there's some good detail in there.

16:45.590 --> 16:50.070
You know, we're clearly at the helm here.

16:50.070 --> 16:52.670
We clearly have the reins of this device now.

16:53.590 --> 17:00.350
You know, we can look at other information on this thing and see if there's more details that we can pull out of it.

17:00.350 --> 17:01.990
More user details.

17:01.990 --> 17:02.910
Maybe some hashes.

17:02.910 --> 17:03.750
Who knows?

17:04.310 --> 17:07.810
But we are in like Flynn here.

17:08.730 --> 17:14.470
So, any questions on that so far?

17:15.450 --> 17:16.510
Hey, Garrett.

17:16.510 --> 17:19.290
Yeah, looks like we have a couple questions here cropping up.

17:19.350 --> 17:26.010
So, Strikeout looks like he's trying to do possibly some U-boot bypass through glitching on a wise came out door.

17:26.010 --> 17:30.190
And this individual is asking where did you actually put the paperclip out on the chip?

17:30.190 --> 17:31.610
A data line?

17:33.990 --> 17:34.550
Yes.

17:34.550 --> 17:36.190
So, that is a great question.

17:36.190 --> 17:37.910
It is a data line.

17:38.070 --> 17:47.690
And it's in between these two flash chips on the... I don't know if I can get a better view of this thing.

17:47.750 --> 17:50.810
But that's looking terrible.

17:51.390 --> 17:52.990
So, I can't... I don't have a micro...

17:54.870 --> 17:58.190
I don't have a magnifier to get you a better view of this.

17:58.190 --> 18:04.930
But basically, there is a pin in between the two chips that is sending data.

18:06.470 --> 18:09.130
It's basically this pin right here.

18:09.130 --> 18:11.870
It's a little silver flat pin there.

18:12.210 --> 18:17.850
And if you look close on the motherboard, you can see the tracks going between those chips.

18:17.850 --> 18:21.310
You can kind of see it, but now it's all blurry, of course.

18:24.840 --> 18:28.520
Yeah, to kind of add to that, this is real quick.

18:29.120 --> 18:40.600
Often, one of the best things to do is once you've identified the flash chips that you're going to attempt this on, is to track down the data sheets on those.

18:40.600 --> 18:47.000
And from the data sheets, in this particular case, I traced out the data zero line.

18:47.680 --> 19:03.840
So, between those two chips, this particular glitch is a little easier timing-wise because the smaller chip that's toward the bottom actually has U-boot on it.

19:03.840 --> 19:06.120
The other chip has the kernel on it.

19:06.120 --> 19:15.480
So, the goal is to find the data line for the chip containing a kernel and interrupt that by taking it to ground.

19:15.860 --> 19:35.540
And the attempt there is U-boot's loaded, and before it has a chance to actually load the kernel or call the kernel, you literally take one of those data lines to ground, causing it to fail to read it, as Garrett was talking about and as he showed there.

19:42.970 --> 19:45.910
One other question here, Garrett, that is cropping up.

19:45.910 --> 19:53.530
Individual asks, what type of device are you using to interact with the device here via UART?

19:53.530 --> 19:55.510
Are you using something like a Shikra?

19:56.970 --> 19:58.490
Yeah, let me show you.

19:58.490 --> 20:00.970
I can show you what that is here.

20:01.930 --> 20:05.570
We got one right here to show you.

20:06.250 --> 20:09.570
So, let me kill out this thing real quick.

20:12.450 --> 20:17.710
So, we're going to disconnect and pull this thing right out of my laptop for you.

20:21.300 --> 20:22.720
Hold power.

20:22.740 --> 20:23.240
All right.

20:23.240 --> 20:36.960
So, to give you a better idea of what this thing is, it's basically just a little USB with a chip attached to it with several different header connections on it.

20:37.300 --> 20:44.460
It comes with a data sheet that kind of breaks down what these connectors are, but that's literally all it is.

20:44.460 --> 20:45.740
It has three cables.

20:45.740 --> 20:47.300
I don't know where my camera is.

20:47.300 --> 20:52.520
It's got three cables, one for ground, one for receive and transmit.

20:52.520 --> 20:56.720
So, that's how I'm connected directly to this device.

20:56.720 --> 20:59.720
So, hopefully that helps.

21:00.340 --> 21:05.140
But you can pick these things up off the internet.

21:05.140 --> 21:08.820
I think they're 30 or 40 bucks.

21:08.820 --> 21:12.780
I can't remember how much they cost, but they're doable.

21:13.740 --> 21:19.320
And there's some other devices out there like Pirate.

21:19.540 --> 21:23.520
There's one called, I think, UART Pirate or something like that, or Pirate Bay.

21:23.520 --> 21:29.800
I can't remember what the name of it is, but there's several tools out there that do the same, essentially the same thing.

21:29.800 --> 21:32.100
This is just the one that we use today.

21:34.600 --> 21:35.180
Cool.

21:35.180 --> 21:38.380
That's, I think, the last of the cute questions that we have here.

21:38.380 --> 21:40.040
Bus Pirate, I think, was the word you're looking for.

21:40.300 --> 21:42.200
That's what it was, Bus Pirate.

21:43.860 --> 21:44.960
Oh, man.

21:45.080 --> 21:45.580
Yep.

21:45.580 --> 21:47.240
I knew it was something to do with the pirates.

21:47.240 --> 21:49.980
Pirate would be pretty good too, I like the ring to none.

21:51.740 --> 21:53.040
Right on.

21:53.080 --> 21:53.920
Cool.

21:54.040 --> 22:01.380
Well, let me, if that's all the questions, let me just get back to the slides here and move on.

22:02.580 --> 22:05.700
So, now we're going to switch gears a little bit.

22:05.700 --> 22:14.940
We're going to be going over some common problems with embedded devices and then using U-boot to solve them.

22:15.500 --> 22:20.700
So, I'm going to switch gears and pass it over to my colleague, Darryl Hyland, and take it away from there.

22:20.700 --> 22:22.300
Let me just stop my share.

22:24.520 --> 22:25.700
Thanks, Garrett.

22:26.040 --> 22:29.660
Let me go ahead and share my screen.

22:31.020 --> 22:33.200
Hopefully, everyone can see my screen.

22:35.560 --> 22:40.740
So, kind of get back to the actual hue.

22:40.740 --> 22:50.440
So, I went and configured this hue to kind of exhibit some of the common problem that you will often encounter.

22:50.440 --> 22:57.640
And I know I've hit it two or three times working on IoT gear in the last year or so.

22:57.640 --> 23:01.580
And I know Jonathan has also encountered it.

23:01.640 --> 23:05.960
And again, this here is just a standard hue.

23:06.020 --> 23:11.820
And then this here happens to be a quad UART device.

23:11.820 --> 23:12.820
I kind of like this one.

23:12.820 --> 23:14.280
It's a little different than the Shikra.

23:14.280 --> 23:20.200
This one actually takes four different UARTs and you can switch between three and a half and four volts.

23:20.200 --> 23:21.740
And it's all USB-based.

23:21.740 --> 23:24.300
So, it's kind of sweet.

23:24.300 --> 23:28.500
I like using that if I need multiple UARTs at the same time.

23:28.800 --> 23:31.660
Sometimes... let's go ahead and plug this device in.

23:31.660 --> 23:34.000
Make sure everything's going to come up here.

23:34.800 --> 23:39.620
So, again, often when you're encountering devices, they'll come up.

23:39.620 --> 23:42.180
And if you noticed, it had the boot delay.

23:42.180 --> 23:45.940
I put the boot delay on here just to avoid having the glitch again.

23:45.980 --> 23:53.540
But the ping glitch to force into a U -Boot console is a literally very common method.

23:53.540 --> 23:57.340
But as you see, we hit a point here where it's literally disabled.

23:57.340 --> 23:59.300
We no longer have a console.

24:00.260 --> 24:02.960
And this is not uncommon.

24:02.960 --> 24:15.740
You'll have a device where you're actually able to establish a UART connection on the device and start seeing it boot up.

24:15.740 --> 24:22.780
But then inevitably when it's booted up, there's literally no console whatsoever on that device.

24:22.780 --> 24:24.740
I've had it go up to this point.

24:24.740 --> 24:26.560
You'll see console disabled.

24:26.560 --> 24:31.140
I've seen it come up and not tell me console disabled, just say loading kernel.

24:31.140 --> 24:33.520
And then you see nothing after that.

24:33.520 --> 24:44.380
So, whether you need to use a ping glitch or they've enabled the boot delay or some method you can gain access to it, we're going to go ahead and go through that.

24:44.380 --> 24:49.940
And often, the fix for this is typically very simple.

24:50.640 --> 24:53.160
Let's see if I can catch this here.

24:53.520 --> 24:54.220
Okay.

24:56.800 --> 25:00.740
Actually, which is funny, that did not work for me.

25:00.740 --> 25:04.360
So, we'll see.

25:05.340 --> 25:07.860
This is going to be funny if this doesn't work.

25:07.860 --> 25:12.360
It wouldn't surprise me if Zoom caused the problem.

25:12.360 --> 25:15.440
Because, okay, we're able to get into it.

25:15.440 --> 25:21.240
So, back to those common commands that Garrett had mentioned, like print environment.

25:21.240 --> 25:23.880
So, we're going to come over here and print environment.

25:23.880 --> 25:28.360
And again, there's literally tons of environment variables.

25:28.380 --> 25:32.540
A lot of these environment variables are part of the boot process, like Garrett said.

25:32.540 --> 25:36.440
Some of these actually pass commands to the kernel.

25:37.260 --> 25:40.940
So, the kernel knows what to do as it's loaded up.

25:41.460 --> 25:47.940
And often, where you see alterations that need to be made, the most common one is bootargs.

25:48.180 --> 25:51.060
You'll see bootargs showing the configurations.

25:51.060 --> 25:56.840
But when we come over here, we see bootargs console is actually set normal.

25:56.840 --> 25:58.620
So, maybe it's somewhere else.

25:58.620 --> 26:04.060
But here, we found out they have another environment variable called standard bootargs.

26:04.060 --> 26:08.260
So, apparently, this is what's being called at some point.

26:08.700 --> 26:12.980
Thus, we see the null taking place in here.

26:13.920 --> 26:17.440
Sometimes, this will involve very experimental.

26:18.060 --> 26:25.500
First time, when I was setting this up to identify it, that's when I found out that this bootargs segment doesn't work.

26:25.500 --> 26:28.320
And then you need to do it some other way.

26:28.320 --> 26:31.600
And then turns out it was the standard bootargs.

26:31.600 --> 26:44.580
So, to go ahead and do this, again, like you did, you go, you set the environment, which was standard std bootargs.

26:46.020 --> 26:49.780
Something always to remember also.

26:51.780 --> 26:54.660
In this case, I'm going to rewrite the entire one.

26:54.660 --> 26:56.920
And we're going to set the console here.

27:04.280 --> 27:06.420
And look at our standard bootargs.

27:06.420 --> 27:08.100
Make sure there's not another one.

27:08.100 --> 27:11.880
You would be surprised how many times I've misspelled something.

27:11.880 --> 27:13.180
And it's easy to do.

27:13.180 --> 27:19.760
And what you end up doing is just creating another argument that isn't read by the system or used.

27:19.980 --> 27:21.280
So, then you boot the system.

27:21.280 --> 27:23.100
It goes, well, it didn't fix anything.

27:23.100 --> 27:24.620
What went wrong?

27:24.800 --> 27:27.060
Often, it's just a typo.

27:27.200 --> 27:29.840
You've seen where people have made typos up here.

27:29.840 --> 27:31.080
Here's an example.

27:31.080 --> 27:32.300
Security, security.

27:32.300 --> 27:33.700
That's kind of weird.

27:33.700 --> 27:38.900
So, again, that's probably a typo that took place there.

27:38.900 --> 27:43.120
So, at this point, we'll go ahead and go save environment variables.

27:44.460 --> 27:46.880
Write the environment variables back out.

27:46.880 --> 27:53.460
And then the reset command will cause the CPU to reset on the device from the U-boot console.

27:54.020 --> 27:56.720
So, let's see if this will actually work.

27:57.600 --> 27:59.460
And it's kind of amazing.

27:59.460 --> 28:12.700
Out of the number of times I've done this, more than three quarters of the time when the device did boot up.

28:14.590 --> 28:16.390
Oh, that's interesting.

28:16.390 --> 28:20.730
We seem to have a crash on the system.

28:21.250 --> 28:23.590
We had a kernel panic.

28:24.790 --> 28:26.350
That's interesting.

28:32.210 --> 28:34.430
So, demos do go bad.

28:34.430 --> 28:37.530
So, we will see what we have here.

28:39.030 --> 28:40.870
This doesn't come up.

28:41.190 --> 28:43.190
We're probably just going to move on.

28:43.810 --> 28:48.770
Typically, you make these changes on the system.

28:49.050 --> 28:50.990
Yep, we got another kernel panic.

28:50.990 --> 28:58.490
I'm going to take one more check and see what corrupted.

29:16.570 --> 29:18.290
Yeah, that's correct.

29:19.750 --> 29:23.550
So, we're not going to waste much time on this.

29:23.570 --> 29:25.550
And we're just going to move on.

29:25.690 --> 29:28.490
Typically, there may be something in here.

29:28.490 --> 29:30.330
Sometimes these things go bad.

29:30.470 --> 29:36.310
But normally, just by fixing the console setting, for some reason, my kernel's messed up.

29:36.310 --> 29:37.690
I'm not sure how that happened.

29:37.690 --> 29:41.770
Maybe from constantly rebooting this thing over and over and over.

29:42.410 --> 29:45.890
Maya finally said, hey, I'm not going to play anymore, corrupted something.

29:46.170 --> 30:06.070
But typically, when you go into the uBoot console, and you've broke into it, and you have a device that will not give you a console after boot up, a lot of times you can go in here and alter either boot args or some other reference that's used for the boot arguments that tell the kernel what console,

30:06.070 --> 30:10.690
what bauld rate, all those typical things, and set that, and it'll come up.

30:10.810 --> 30:27.010
Usually, three quarters of the time, when I've encountered this on commercial gear, where they've actually turned the console off trying to hide access, when I do allow it to boot up, it's giving me root access from the very get-go versus giving me a password prompt.

30:27.070 --> 30:29.570
It's giving me root access.

30:29.570 --> 30:41.830
So, again, the best way to do this is check the console settings, make sure they're correct, make sure they haven't turned initialization off.

30:41.830 --> 30:49.250
I've seen this messed with, which would cause weird things in killing consoles and stuff like that.

30:49.930 --> 30:55.050
But typically, nine times out of ten, it's literally going to be the console setting.

30:55.050 --> 31:10.230
If it's not set, often when you identify the processor that may be used in this case, you can do a little Google reference and identify the most common TTY setting for that.

31:10.230 --> 31:19.190
A lot of times it's in the data sheet and stuff like that, to identify how it is naming its primary console TTY.

31:19.190 --> 31:31.270
So, often data sheets, a little Google on the device or the processor in case, to be able to identify that, and that helps you to literally set the console where it actually needs to be.

31:31.270 --> 31:37.330
Unfortunately, that demo failed, even though it's worked 40 times up until today.

31:37.670 --> 31:43.830
And I will stop sharing and turn this over to Garrett, so he can attempt his next demo.

31:44.310 --> 31:47.950
Is there any questions related to this particular failure?

31:49.870 --> 31:50.670
Let's see.

31:50.670 --> 31:55.930
It looks like there's a couple folks that are helping to troubleshoot, and I saw one of the issues too, I think.

31:56.090 --> 31:59.090
I guess it looks like bootargs was double set.

31:59.450 --> 32:02.290
Also, the board equals appeared to be missing.

32:02.290 --> 32:04.670
The bootargs, I think, for sure, might have been one of them.

32:04.750 --> 32:09.490
The board equals might take a little troubleshooting, but that's a couple questions, I guess, that came up.

32:09.490 --> 32:11.030
But another... Oh, yeah, got it right there.

32:11.030 --> 32:11.590
I see it.

32:11.590 --> 32:11.910
Yep.

32:11.910 --> 32:12.190
Yeah.

32:12.390 --> 32:13.770
Good catch, guys.

32:13.770 --> 32:14.330
Yep.

32:15.290 --> 32:20.350
Often when you're cutting and pasting, it's very difficult to do that.

32:20.350 --> 32:23.230
Since I didn't define the board, that obviously called it.

32:23.230 --> 32:25.070
So, good catch out there.

32:25.070 --> 32:25.870
Yeah.

32:26.270 --> 32:32.950
Props to folks on Twitch as well as here in the panel as well that kind of caught that.

32:32.950 --> 32:35.530
But there is a couple questions that did crop up.

32:35.530 --> 32:42.970
One individual asks, how often do you find that IoT devices are actually using U-boot?

32:42.970 --> 32:46.310
Like, would you say about 75%, 50%?

32:46.890 --> 32:55.030
I'd have to say it's still probably a little higher than 50% that I engage devices that U-boot used.

32:55.370 --> 33:02.690
Now, if they're running the latest version of U-boot, this typical pin glitch will not work.

33:03.010 --> 33:17.030
So, what happens is the newer version of U-boot that is out there, if anyone is actually using it, is supposed to, when it can't learn, it can't load the kernel, will actually restart the U-boot process.

33:17.030 --> 33:22.390
So, it'll just go into an infinite loop until it can load the kernel in that case there.

33:22.390 --> 33:25.290
That's how they kind of started to fix this problem.

33:25.290 --> 33:30.370
I assure you there's probably attack methods in that case with that to get around to it.

33:30.370 --> 33:40.970
But the best fix, what we always recommend to most vendors on how do you solve the problem with U-boot being an issue is start using secure boot.

33:44.650 --> 33:51.090
That actually answers the last question that I had here was, what's the best way of overcoming some of these issues?

33:51.090 --> 33:54.130
And it sounds like secure boot's the best method for that.

34:02.870 --> 34:08.570
Yeah, I would say secure boot is the best solution to these issues that we're running through today.

34:11.610 --> 34:16.990
And I think we had another question just popped up here that we can kind of squeeze in before we move on.

34:16.990 --> 34:19.070
Because there's one more demo, is that correct, Garrett?

34:19.310 --> 34:21.410
Yeah, yeah, we still got one more.

34:21.410 --> 34:23.750
But yeah, more questions, the more the merrier.

34:23.750 --> 34:24.270
Okay, yeah.

34:24.270 --> 34:31.570
So, Asher asks, do you know why sometimes the environment variables cannot be modified even with root access to the U-boot console?

34:31.810 --> 34:34.510
This apparently has happened for this individual.

34:36.870 --> 34:48.150
The only thing I can think of off the top of my head is that the manufacturer hard set some of those environment variables to not allow change even at a root level.

34:48.610 --> 35:01.170
Or there's just some underlying permissions that, you know, even though we may feel we're root, there may be some hard coded just permission set there that we just can't get into.

35:01.170 --> 35:03.490
I don't know, maybe someone else has more to speak on that.

35:03.490 --> 35:07.550
But that's just my initial gut feeling.

35:09.270 --> 35:11.830
I'd have to agree with that.

35:11.830 --> 35:14.530
I actually had a device I was playing with the other day.

35:14.530 --> 35:24.490
And there was probably a half dozen arguments in the environment variables that when I changed them and saved them, they never saved nothing.

35:25.110 --> 35:28.290
So, U-boot's a funny beast.

35:28.430 --> 35:31.450
Everybody compiles it differently.

35:31.470 --> 35:38.430
So, the amount of features, functions, capabilities, and how it works is very configurable.

35:38.430 --> 35:41.510
And every vendor will compile it and use it different.

35:41.750 --> 35:49.330
Also, I've seen some where boot args and all of those settings are not even used by the kernel.

35:49.730 --> 35:54.650
That stuff is actually hard coded into some kernel configurations.

35:54.670 --> 36:07.110
So, alterations with boot args don't actually work, which can be problematic too when you're trying to carry out some level of tax.

36:07.510 --> 36:18.510
Based on that, I think what Garrett's going to demo here just shortly will actually open up some other possible opportunities.

36:19.010 --> 36:32.630
If you're able to break in to the U-boot console, some of the stuff he's going to show may be very helpful in gaining a level of access into the system.

36:36.720 --> 36:37.700
Awesome.

36:37.700 --> 36:40.860
Any other questions out there, John?

36:40.860 --> 36:42.560
I think we're kind of on the queue.

36:42.560 --> 36:43.740
I think we're good to go.

36:43.760 --> 36:44.500
All right.

36:44.500 --> 36:45.040
Right on.

36:45.040 --> 36:46.100
Moving on.

36:46.560 --> 36:52.400
So, next, we're going to be going over the Luma.

36:52.400 --> 36:56.760
The Luma is that mesh device that we were looking at.

36:57.160 --> 37:01.380
It's got a little bit more to it on the motherboard itself.

37:03.180 --> 37:04.780
There's just a lot more going on.

37:04.780 --> 37:06.200
It has onboard Ethernet.

37:06.200 --> 37:07.640
It's got a USB port.

37:07.640 --> 37:11.320
It's got several different places to connect wires.

37:11.320 --> 37:12.380
There's some headers.

37:13.300 --> 37:14.660
A lot of stuff going on.

37:14.660 --> 37:18.180
I think it's got a built-in Wi-Fi chip on it, possibly.

37:18.180 --> 37:19.160
I'm not sure.

37:19.160 --> 37:21.620
But a lot of stuff going on there.

37:21.620 --> 37:30.160
So, we're going to boot to root here real quick out of these slides back into the live action.

37:30.160 --> 37:30.660
Here we go.

37:30.660 --> 37:35.960
So, now I got my Luma set up here, broken down, ripped it apart.

37:36.500 --> 37:42.540
I've got my UART connection over here with my ground, my receive, and my transmit.

37:42.540 --> 37:43.480
We're all good.

37:43.920 --> 37:49.400
I have my Ethernet actually plugged in because I'm just going direct line to this thing.

37:49.620 --> 37:53.460
And then I also have a ground wire that you can't really see.

37:53.460 --> 37:58.560
But there is a ground wire soldered onto the board over here.

37:58.560 --> 38:04.740
So, the way that I did get into this thing initially was a pin glitch.

38:05.760 --> 38:07.840
And I'm not going to show that today.

38:07.840 --> 38:11.920
But if it's something you want to see, I can demo it later if we have time.

38:11.920 --> 38:20.680
But basically, this particular chip right here is the chip that we are compromising to break into this thing.

38:20.800 --> 38:25.960
And it's actually this pin right here, this data pin right over here, the second one up.

38:26.200 --> 38:27.640
I don't know if you can even see that.

38:27.640 --> 38:32.500
But there's eight pins around that square chip.

38:32.840 --> 38:39.120
And we're going to short the data line or the data pin on that thing.

38:39.120 --> 38:41.040
So, that's how we would have got into this thing.

38:41.040 --> 38:47.160
But since we already did that, the magic of television, we're just going to plug some power into this thing.

38:47.980 --> 38:48.200
Okay.

38:48.200 --> 38:49.620
We got power now.

38:50.360 --> 38:53.360
And a little bit more slack in that line.

38:54.480 --> 38:56.180
The trusty toe.

38:56.600 --> 38:57.900
Come on, toe.

38:57.900 --> 38:59.100
There it is.

38:59.580 --> 39:00.860
And we're connected.

39:00.920 --> 39:02.200
And there it goes.

39:02.200 --> 39:09.900
So, what's funny about Cool Term is you have these receive and transmit lights going on in the bottom.

39:09.900 --> 39:13.200
So, we know that we're getting data in some way somehow.

39:14.320 --> 39:17.940
And again, with the boot up process, a lot of information here.

39:18.020 --> 39:21.020
And obviously, we can all read extremely fast.

39:21.020 --> 39:23.500
That's how we're able to read everything that's going down the screen.

39:23.900 --> 39:25.040
No, probably not.

39:25.060 --> 39:28.600
There's ways to extract this if you wanted to.

39:28.600 --> 39:32.420
Kind of if you recorded this and just played it back slow.

39:32.580 --> 39:35.340
And you could be taking like screenshots as it goes through.

39:35.340 --> 39:40.080
There's plenty of ways to kind of extract everything that's going on here.

39:41.120 --> 39:44.940
This one actually takes a little bit longer to boot up than the Hue.

39:45.120 --> 39:47.880
I think just because it has more functionality to it.

39:47.880 --> 39:55.760
It's not just going to turn your lights blue or green or red or whatever the ambience for the evening happens to be.

39:55.900 --> 39:59.600
This time, it's actually going to provide internet connection.

39:59.760 --> 40:04.300
So, when people come over or you have parties, not so much anymore.

40:04.300 --> 40:08.100
But when we did, you want to have everyone be able to have internet.

40:08.100 --> 40:11.300
We got to be staying up to date on our socials.

40:11.300 --> 40:14.160
We got to be, you know, staying up to date on everything.

40:14.160 --> 40:16.560
So, internet is good.

40:17.340 --> 40:19.760
So, we may not wait for this whole thing to boot up.

40:19.760 --> 40:22.100
I think it takes about a couple minutes.

40:22.380 --> 40:24.160
And my patience is weak.

40:24.160 --> 40:29.460
So, as this thing kind of rounds the bend here, it looks like it's doing stuff with Wi-Fi.

40:30.080 --> 40:33.440
Looks like some connections were going on, some different channels.

40:34.800 --> 40:36.200
Let's just see what happens.

40:36.200 --> 40:37.120
Oh, okay.

40:37.120 --> 40:38.500
So, we got a login prompt.

40:40.260 --> 40:42.040
We can try to log in.

40:42.060 --> 40:43.740
I don't know the password, though.

40:45.100 --> 40:46.780
Let's give it a shot anyway.

40:47.320 --> 40:48.580
Login incorrect.

40:48.660 --> 40:50.580
So, no luck again.

40:50.580 --> 40:54.720
We're 0 for 2 there on trying to just log into these things.

40:55.460 --> 40:57.040
So, what can we do?

40:57.040 --> 40:59.460
We're just going to power cycle this thing.

41:01.680 --> 41:02.240
All right.

41:02.240 --> 41:03.260
So, clear.

41:03.920 --> 41:04.800
Clear.

41:04.860 --> 41:05.380
All right.

41:05.380 --> 41:07.180
Pinky toe in action.

41:07.880 --> 41:08.600
All right.

41:08.600 --> 41:17.600
So, like I said before, the, you know, how the cooking shows do it, they don't cook that whole turkey right in front of you.

41:17.600 --> 41:18.520
That would be crazy.

41:18.840 --> 41:20.900
But they have one already in the oven.

41:20.900 --> 41:32.100
So, that's kind of what happened here is I pin glitched this thing prior to this call so that I did set this boot delay so that I could break out of it and get in there and actually show you some stuff.

41:32.100 --> 41:35.560
So, similar to before, print environment variables.

41:35.560 --> 41:36.780
We can just ask for help, though.

41:36.780 --> 41:41.080
Just see what's different about the Luma versus the Hue.

41:41.680 --> 41:43.840
So, some slight differences.

41:44.100 --> 41:48.660
This one's not as long as far as the list of items that we can do.

41:49.100 --> 41:58.640
So, just kind of piggybacking on that final question before is, you know, U-Boot is configured differently on every device, or essentially it can be.

41:59.140 --> 42:03.160
So, I was even reading up on this company called Emac.

42:03.160 --> 42:07.780
I think they do, Skada devices.

42:07.820 --> 42:14.600
And the way that they configure U-Boot was completely different than another person who configured U-Boot.

42:14.600 --> 42:21.760
Because when I was looking things up on this stuff, I would find several different explanations.

42:21.760 --> 42:22.860
Like, well, wait a minute.

42:22.920 --> 42:24.460
Is this even the same thing?

42:24.460 --> 42:25.400
Like, yeah, it is.

42:25.400 --> 42:29.740
It just can be completely configured, you know, in several different ways.

42:30.260 --> 42:33.020
Or compiled, I guess is the right word to use.

42:33.020 --> 42:46.500
So, if we look at some of these things, what jumps out to me is the boot arguments, the boot IPQ, boot from a flash device, boot from memory, boot from a network connection using TFTP.

42:48.340 --> 42:49.840
Spoiler alert, maybe.

42:50.140 --> 42:55.540
We got ping, so we can actually test ping connections.

42:55.680 --> 42:57.580
Print environment, like we already know.

42:57.580 --> 43:00.420
Save environment, set environment, that's all there.

43:01.480 --> 43:05.820
Print the memory flash information.

43:06.640 --> 43:09.300
There's a TFTP boot command right there.

43:09.380 --> 43:10.780
Oh, and a USB boot.

43:10.780 --> 43:11.840
So, a lot of stuff.

43:11.840 --> 43:16.040
This thing has a USB onboard, so, you know, there's more opportunities here.

43:17.660 --> 43:22.180
So, today, let's get back into the print environment.

43:22.180 --> 43:23.880
Let's take a look back at this.

43:24.960 --> 43:27.340
Today, we already have set the boot delay.

43:27.340 --> 43:28.380
That's already done.

43:28.380 --> 43:29.640
Boot delay is set.

43:30.500 --> 43:34.500
This boot command, though, is set to that boot IPQ.

43:34.500 --> 43:38.740
And if you don't remember, we can just quickly look back at that boot IPQ.

43:38.740 --> 43:40.220
What the heck is that?

43:41.360 --> 43:43.160
So, here it is.

43:43.160 --> 43:44.400
Boot IPQ.

43:44.400 --> 43:46.980
And it's to boot from flash device.

43:46.980 --> 43:50.600
So, that's what it's set out of the box from the manufacturer there.

43:51.220 --> 43:55.740
So, if we get back into those environment variables, what else can we mess with?

43:56.480 --> 43:57.760
Let's see.

43:57.760 --> 43:59.000
So, IP address.

43:59.000 --> 44:01.200
Ah, IP address is important.

44:01.220 --> 44:03.140
And we also have server IP.

44:04.060 --> 44:06.300
So, what can we do with those?

44:06.300 --> 44:13.220
So, basically, this IP address, this Luma device does not have networking configured out of the box.

44:13.220 --> 44:17.980
So, when it turns on, it just has a random IP in there.

44:18.560 --> 44:30.520
And I just set it to an available IP on the network that isn't already being used by the Xbox or the PlayStation or the 10 Raspberry Pis or the N64.

44:30.520 --> 44:30.980
You know what I'm saying?

44:30.980 --> 44:32.680
All these devices out here.

44:32.780 --> 44:34.360
So, I just chose a random IP.

44:34.360 --> 44:36.020
Doesn't really matter.

44:36.080 --> 44:38.380
What does matter is the server IP.

44:38.380 --> 44:44.000
The server IP is going to be the TFTP server.

44:44.460 --> 44:50.900
So, we're gonna be using TFTP to boot this thing or to boot from TFTP.

44:50.900 --> 44:55.500
And that's where this extra server comes into play.

44:55.500 --> 45:03.660
So, I got my just a Ubuntu 16.04, just fresh ISO I just pulled down the other day.

45:04.120 --> 45:08.280
And just found a couple articles online on how to set up a TFTP server.

45:08.320 --> 45:09.680
It's really straightforward.

45:10.360 --> 45:12.900
You know, if I can do it, I'm sure anybody on the call can do it.

45:12.900 --> 45:21.360
Because it's just creating a file, setting the right parameters in that file, and then making sure the service is up and running.

45:21.360 --> 45:28.020
I can't tell you how much pain I was having literally yesterday about trying to get this thing to work.

45:28.020 --> 45:30.420
And literally, I didn't really change much.

45:30.420 --> 45:31.640
And it just started working again.

45:31.640 --> 45:34.860
So, we're gonna see how well today goes.

45:34.860 --> 45:38.320
But anyway, it looks like it's up and running.

45:38.320 --> 45:41.660
We can just see if this is still good to go.

45:41.660 --> 45:43.660
All the passwords, super secret.

45:44.040 --> 45:44.500
All right.

45:44.500 --> 45:47.160
So, we're still running as of 1529.

45:47.160 --> 45:49.140
So, right on schedule there.

45:49.960 --> 45:50.920
Cool.

45:50.920 --> 45:54.420
And if we look at the IP of this device, that might help, right?

45:54.680 --> 45:56.160
I have config.

45:57.120 --> 45:58.080
Let's see.

45:58.080 --> 46:02.440
So, this is 192.168.118.

46:02.440 --> 46:04.600
So, that's where that IP comes into play.

46:05.260 --> 46:05.820
All right.

46:05.820 --> 46:06.540
Cool.

46:06.880 --> 46:09.880
So, jumping back to this now.

46:10.560 --> 46:14.840
So, this boot command is set to this.

46:14.840 --> 46:20.580
We can actually override this particular boot command here.

46:20.620 --> 46:22.580
And these boot arguments.

46:23.260 --> 46:25.940
Sorry, there might be a neighbor calling for their cat.

46:25.940 --> 46:33.900
So, I've actually already gone ahead and wrote out this command just for sake of typoing this thing a million times.

46:34.280 --> 46:36.000
I'm just gonna copy it over.

46:38.460 --> 46:40.920
And if you notice, I didn't show it, actually.

46:40.920 --> 46:51.140
But if I go back to my VM, I have a kernel image over here that has been compiled using open WRT.

46:51.600 --> 46:57.980
So, it's this is the package or the image that we're gonna be calling from my TFTP server.

46:57.980 --> 47:01.220
So, I just dropped it on the desktop here.

47:01.260 --> 47:04.280
I have it in several locations just because I was testing.

47:04.300 --> 47:08.240
So, I think it just needs to be on the root drive, just accessible.

47:09.260 --> 47:12.500
So, good stuff there.

47:13.180 --> 47:17.140
And now that we're back here, I'm just gonna paste this command.

47:19.670 --> 47:20.230
Cool.

47:20.230 --> 47:21.170
Just like that.

47:21.170 --> 47:28.050
So, I'm using TFTP boot, which is one of those help arguments, if you remember.

47:28.050 --> 47:30.730
There was a TFTP boot argument that we could use.

47:31.230 --> 47:34.690
And then I'm telling it, which piece of memory do I want to boot from?

47:34.690 --> 47:37.050
And I want to boot this particular image.

47:37.450 --> 47:41.010
And then boot at this particular address in memory.

47:41.010 --> 47:43.530
So, that's what this command is meant to do.

47:43.530 --> 47:46.310
So, without further ado, let's see how it goes.

47:46.310 --> 47:49.330
Let's just hit the big red button.

47:50.590 --> 47:55.890
And right away, you can see that it's using an Ethernet device, eth0.

47:56.170 --> 47:57.550
So, it is connected.

47:57.550 --> 48:02.690
It's from the server, my TFTP server at 1.18.

48:02.890 --> 48:06.610
And then from our address, .25.

48:07.130 --> 48:10.610
So, looks like we might be in good shape here on the first go around.

48:10.610 --> 48:11.510
How about that?

48:12.450 --> 48:14.710
Looks like it's uncompressing the kernel image.

48:14.710 --> 48:15.450
It's booting it up.

48:15.450 --> 48:18.430
You can see the OpenWrt right here, if you catch it.

48:19.930 --> 48:21.830
And then it's off to the races.

48:22.090 --> 48:29.330
So, as this thing kind of boots up, we'll see if we got any further than that login prompt that we had before.

48:30.230 --> 48:34.850
And if you're not familiar with OpenWrt, it is open source.

48:35.210 --> 48:44.090
And those can also be kind of compiled a little bit differently depending on, you know, what you want to do with it.

48:44.090 --> 48:49.590
So, by the way, the devices, if you wanted to buy these devices, very cheap on eBay.

48:49.590 --> 48:51.490
You can pick them up here.

48:51.610 --> 48:52.970
Very cheap.

48:52.970 --> 48:53.910
Just search eBay.

48:53.910 --> 49:06.910
But this OpenWrt, it's basically just an open source project that you can compile different, you know, different things and connect to different devices.

49:06.910 --> 49:08.630
It's just fully customizable.

49:09.330 --> 49:12.290
So, that's a little bit about what's going on there.

49:14.370 --> 49:15.170
Let's see.

49:15.170 --> 49:21.270
So, as this thing kind of boots up, see if we just hit one of these random buttons over here.

49:21.790 --> 49:22.470
Boom.

49:22.790 --> 49:24.190
So, that did it.

49:24.190 --> 49:28.870
We are in a built-in shell on the Luma device.

49:29.070 --> 49:33.470
So, this technically is not the Luma OS.

49:33.570 --> 49:35.470
So, I want to be clear on that.

49:35.470 --> 49:38.450
We didn't just root the whole Luma device.

49:38.450 --> 49:54.990
What we did is we created a kind of a landing place for kind of like before the OS hits the ground, we created our own OS and said, hey, we want to boot to our OS before you even get to yours.

49:55.090 --> 49:55.670
Okay?

49:55.670 --> 49:57.190
So, that's what this is.

49:57.490 --> 50:01.110
And so, it's not the direct file system on the Luma.

50:01.130 --> 50:08.430
But we can still do things similar to the Hue where we can, you know, dig into the root file system.

50:08.430 --> 50:10.090
We can look at the kernel, the firmware.

50:10.090 --> 50:12.630
There's a lot of things that we can potentially get into.

50:13.270 --> 50:15.650
There's several different techniques to do that.

50:16.030 --> 50:19.710
One of them would be mounting these drives.

50:19.710 --> 50:27.850
So, assuming that we had full permission, then we would just mount these drives and start extracting data from there.

50:28.190 --> 50:34.270
If we don't, you know, in a situation where we don't have access, say like for right now, like we have all zeros here.

50:34.270 --> 50:37.270
So, it's possible that we don't have access to this right now.

50:37.270 --> 50:44.690
So, what we could do is use something like DD to extract the data that way.

50:44.690 --> 50:55.610
It's a command line tool or something like TFTP and just siphon the data to another medium and then perform, you know, additional analysis there.

50:55.610 --> 51:01.250
But as far as from where we are right here, there are some things that we can do.

51:01.250 --> 51:13.910
But it is kind of in this open WRT console now where we'd have to get a little bit creative and kind of use our noggins and find another path to the Luma OS.

51:13.910 --> 51:15.170
But it's possible.

51:16.510 --> 51:20.810
So, that's a little bit about what we got going on on this thing.

51:20.810 --> 51:27.810
We wanted to show, you know, booting to an OS that we compiled on the device itself.

51:28.590 --> 51:32.430
So, that's a little bit about what we got going on here.

51:33.030 --> 51:36.810
Any questions on how we got to this point?

51:39.650 --> 51:40.390
Yep.

51:40.390 --> 51:42.130
A couple questions here.

51:42.130 --> 51:43.230
Let me take a look.

51:44.230 --> 51:49.370
One individual asks, I assume all of these attacks require physical access.

51:49.370 --> 51:53.410
There's no way of performing this attack remotely.

51:53.410 --> 51:54.610
Is that correct?

51:55.470 --> 51:56.030
Yes.

51:56.030 --> 52:05.630
So, unfortunately, if you did want to, you know, start doing some war driving or something or mess with your family members, whatever, it's all ethical, right?

52:05.830 --> 52:09.530
You know, you would have to have physical access to these devices.

52:09.610 --> 52:23.630
I imagine you could get physical access one time and then set up some type of logic bomb or some type of, you know, hook into the device so that if it were online, it could call to us in some way or somehow.

52:23.710 --> 52:27.970
Probably some of the devices that have internet connection more so than not.

52:27.970 --> 52:35.430
But I know that I have the light bulbs from Costco.

52:35.430 --> 52:40.850
I think they're called... oh, man, now I'm drawing a blank on it.

52:40.850 --> 52:43.310
But it's basically the same thing as the Philips Hue.

52:43.690 --> 52:45.590
And it's the Costco version.

52:45.590 --> 52:47.070
I can't remember the name of it now.

52:47.110 --> 52:48.490
It's driving me nuts.

52:48.490 --> 52:54.730
But basically, they were on the internet, and they didn't have very much any security.

52:55.130 --> 52:58.310
And I was just afraid to even mess with it at that point.

52:58.310 --> 53:07.430
I'm like, physical access to this thing.

53:07.430 --> 53:12.270
But, you know, you never know.

53:12.270 --> 53:14.530
So, good question.

53:16.250 --> 53:17.210
All right.

53:17.210 --> 53:19.610
Taking a look at another question here.

53:20.690 --> 53:26.250
As far as... I think this was touched on a little bit earlier as well by Daryl.

53:26.250 --> 53:29.990
But how do you know which pin to take to ground when glitching?

53:29.990 --> 53:33.090
I know earlier we were talking about data zero, data one.

53:33.090 --> 53:42.030
But as far as testing is concerned, how would you know about taking which pin to ground whenever you're performing this type of glitching?

53:42.670 --> 53:44.670
Yeah, that's a good question.

53:44.870 --> 53:51.130
I do have the breakdown of that flash chip on another screen somewhere, somehow.

53:52.130 --> 53:53.130
Bear with me.

53:53.130 --> 53:54.470
Can you still see my screen?

53:54.470 --> 53:56.450
Is it still showing questions?

53:56.870 --> 53:57.590
Yes.

53:57.590 --> 54:02.950
Okay, give me one second and I can get that readout for you.

54:02.990 --> 54:11.970
But basically, it is a data line, and it is the one that we would want to break into.

54:11.970 --> 54:24.150
So, when you look at the data sheets for these devices, you do want to look for the data lines is kind of the idea in finding out where those actually exist.

54:24.650 --> 54:29.710
Let's see if I can't get a good shot of this.

54:29.710 --> 54:31.310
Give me one second.

54:33.790 --> 54:36.030
Okay, got that now.

54:36.030 --> 54:38.770
Let's just minimize some things.

54:40.890 --> 54:41.810
Okay.

54:42.070 --> 54:47.250
So, see if I can't get a better view of this device here.

54:50.200 --> 54:50.880
Okay.

54:50.880 --> 54:53.180
So, you can still see my screen.

54:53.320 --> 54:59.740
What I have on there now is basically the top down view of that exact chip.

54:59.740 --> 55:05.700
So, if I look back to the camera, this is the chip breakdown, this one right here.

55:05.820 --> 55:10.220
I don't know if you can see that, but the one with the little orange paint drop.

55:11.060 --> 55:15.780
So, that's what we're breaking down in this diagram here.

55:16.100 --> 55:17.400
If I can get my pen out.

55:17.400 --> 55:18.240
There we go.

55:18.240 --> 55:22.520
So, the line that we're shorting is this SO line.

55:24.000 --> 55:28.700
This SO line over here, that's the data line.

55:29.240 --> 55:30.980
I can't remember exactly what it stands for.

55:30.980 --> 55:39.360
Maybe Daryl remembers, but that's essentially what we're shorting in this example.

55:43.530 --> 55:44.910
Yeah, exactly.

55:44.910 --> 55:46.970
There's also an interesting question that came up.

55:46.970 --> 55:52.610
When glitching, would it be a little safer to use a resistor in lieu of a paper clip?

55:53.010 --> 55:58.750
There's a possibility you could short a 3.3 or 5 volt trace pin and burn a register.

55:58.750 --> 56:00.830
Yeah, there's always a chance.

56:02.650 --> 56:08.610
That's why it's very important to... I'm not against using a resistor.

56:08.610 --> 56:11.230
I mean, there is some value to that.

56:11.890 --> 56:25.510
If you'd have to experiment around, because obviously you want to interrupt the data significantly enough, and a resistor may or may not drop the voltage enough based on the resistor size.

56:25.770 --> 56:34.070
But in reference to doing that, again, like he's showing here, go ahead and get the data sheets, figure out what you're grounding out.

56:34.070 --> 56:37.590
So, literally, you don't like just smoke something.

56:37.590 --> 56:43.250
To randomly go into a device here and go, oh, I think I'll just start grounding stuff out.

56:43.250 --> 56:48.050
It's almost a guarantee that you will brick the device permanently.

56:48.210 --> 56:55.390
Now, I've had on these glitching attacks, probably successful.

56:55.570 --> 57:09.010
Anytime there's two chips used, where U-Boot is on one chip and the kernel file system is on another, I've had a hundred percent success every time in actually doing that.

57:09.010 --> 57:16.390
I've only had a problem on one device, and it was using... I can't remember the chip it was using.

57:16.390 --> 57:21.670
It was very much more high speed, so getting it at the right time was difficult.

57:21.750 --> 57:43.050
We never destroyed the chip, but during the attack, even though I was taking the data line down the ground, I ended up actually causing it to screw the U-Boot up, and it actually damaged the U-Boot so that the chip would not boot up anymore.

57:43.050 --> 57:46.710
It would come up actually giving you an error in the U-Boot.

57:46.710 --> 57:51.330
Now, how it altered part of the data in the U-Boot during this process, I have no clue.

57:51.330 --> 58:05.390
Maybe it did fry register in there or smoke something, but we were able to pull the chip and then successfully pull the entire operating system off and recover it all anyway, so problem solved.

58:07.730 --> 58:24.510
Yeah, and just to speak on that note too, I've definitely broken enough devices just tinkering just like that and not really looking, you know, doing the right diligence of looking at the data sheet, looking at what am I actually messing with.

58:24.510 --> 58:28.030
It was more like, it's how it works in the movies, so it's how it works in real life.

58:28.030 --> 58:31.450
You know, I'm just going to touch a bunch of stuff and now I'm in.

58:31.450 --> 58:39.070
So, I definitely have a bunch of devices that just are paperweights around, scattered around.

58:41.090 --> 58:43.790
Yeah, that's funny, dude.

58:46.750 --> 58:47.690
Good stuff.

58:47.690 --> 59:01.190
So, that is getting into the Luma and being able to boot up, another operating system such as OpenWrt.

59:03.210 --> 59:17.210
So, if those devices aren't readily available to you, like the Philips Hue and the Luma, things like this, or they're the ones that you use in your house and you're not trying to lose internet in your house, totally get that.

59:17.390 --> 59:22.410
But if you have a Pi laying around, you can do the exercise with a Raspberry Pi.

59:22.750 --> 59:35.730
There's several articles over the internet that you can find how to do this, how to set it up, what you can do with it, and it's pretty wide.

59:36.210 --> 59:43.330
So, this is just an example of a Raspberry Pi that we had connected, one of my colleagues set up for me for this demo.

59:43.330 --> 59:46.570
So, then you have Uboot going on on the right-hand side.

59:46.570 --> 01:00:01.970
It's doing the same kind of song and dance of getting into the flash memory, the kernel, and actually printing the environment variables so that we can tweak them and adjust them and then tell it what we wanted to do.

01:00:02.190 --> 01:00:05.930
So, it's just another example of a Raspberry Pi.

01:00:07.810 --> 01:00:08.930
Cool.

01:00:11.130 --> 01:00:13.510
So, that is all, folks.

01:00:13.510 --> 01:00:19.470
I really appreciate everyone who was able to join this session on a Saturday when we're not in Vegas.

01:00:19.470 --> 01:00:30.950
I'm assuming we're not in Vegas, but normally hungover at this time of the day and, you know, completely, you know, con funk is in full force.

01:00:31.530 --> 01:00:33.570
You know, I don't know what time it is.

01:00:33.570 --> 01:00:34.450
I don't know where I am.

01:00:34.450 --> 01:00:37.330
That's normally the status of this day for me.

01:00:37.330 --> 01:00:42.150
So, it's a little bit different doing this thing virtual.

01:00:42.290 --> 01:00:49.790
So, I appreciate everyone who was able to join and all the questions and, you know, really happy to be here.

01:00:49.790 --> 01:00:53.390
So, if you have any other questions, throw them out there.

01:00:54.330 --> 01:00:56.490
But that's the end of the show.

01:00:56.490 --> 01:00:59.470
Yeah, there was one more question I saw come in in the chat.

01:00:59.710 --> 01:01:05.630
It said, did you download someone else's build for the Luma or did you do it yourself?

01:01:05.810 --> 01:01:16.610
In this particular case, this build was... I actually built this a while back while I was doing some testing on the Luma.

01:01:16.610 --> 01:01:21.310
So, I used OpenWrt's program.

01:01:21.310 --> 01:01:29.810
This is built off an IPQ40 series processors, which is what the processor is on that particular Luma.

01:01:29.810 --> 01:01:35.690
And it's one of the chipsets that's actually supported within the OpenWrt.

01:01:35.690 --> 01:01:47.990
Now, in this particular case, the success of this wasn't 100%, as Garrett pointed out, that the root FS was showing nothing there or zero location.

01:01:47.990 --> 01:01:52.810
And the reason why that is, is because, remember, this is a two -chip system.

01:01:52.870 --> 01:01:59.870
And when you're building an actual firmware package, you have to build out a device tree.

01:02:00.410 --> 01:02:13.950
Now, most of all of the data available on OpenWrt was very well available dealing with one-chip environments.

01:02:14.410 --> 01:02:25.230
But the device tree for the second chip has not been built into this yet, which potentially made that an issue.

01:02:25.350 --> 01:02:43.630
But once you compile it and compile it with the right complete device tree, complete it, then what he showed with PROC MTD, which is the memory technology devices, kind of an abstract layer between the hardware, the physical flash hardware, and the other part,

01:02:43.630 --> 01:03:00.790
you can literally from those potentially mount those file systems up, or you can also DD them off by actually calling them directly through dev MTD 0 through 9 or 10, which is one of the methods.

01:03:00.790 --> 01:03:18.110
It's really easy once you get some kind of console, which would be the ultimate goal of bringing in a new kernel via TFTP, because you would come in, it would have the device tree, you would see the chips, even though they're not mounted up, you can easily DD all of those images off their file system,

01:03:18.110 --> 01:03:33.310
the root file system, and everything from a separate booted kernel like this, giving you the ability to do some offline binwalk and extract the data, hopefully find the root.

01:03:33.510 --> 01:03:52.190
Or inevitably, you could even, when you find the root, you could easily in this particular case, DD it off, explode it out, and then alter it, rebuild it, repack it back in, and then DD it back over that partition area, and then reboot the device.

01:03:52.190 --> 01:03:55.270
And in that fashion, actually change the root password.

01:03:55.430 --> 01:04:03.630
So this particular attack, as he addressed and talked about, will really open up a lot of new avenues to some hardened devices.

01:04:03.630 --> 01:04:07.830
But it all comes down to, can you get access to that UBoot console?

01:04:09.070 --> 01:04:19.390
And also, the presentation or the demo I ran, and the person pointed out where I missed board, that was correct.

01:04:19.390 --> 01:04:27.910
As soon as we jumped off and he moved on, I went ahead, fixed that typo, failed to copy and reboot it, and it came up to the root prompt.

01:04:27.910 --> 01:04:29.850
So that worked out pretty good.

01:04:29.850 --> 01:04:36.590
So good shout out to that person, was able to visually, quickly capture the idea that I missed that little piece.

01:04:36.590 --> 01:04:37.890
So totally cool.

01:04:38.910 --> 01:04:39.790
Nice.

01:04:40.430 --> 01:04:42.470
Yeah, I just wanted to add on that.

01:04:42.530 --> 01:04:56.110
Sometimes on the devices, if you can still see my screen, the prompt, the command prompts on the Luma is actually the name of the chip, the IPQ40.

01:04:56.350 --> 01:05:03.950
So sometimes you can get even more details from just the device itself, just telling you like, hey, this is what I am.

01:05:03.950 --> 01:05:06.050
Hope this helps, you know.

01:05:06.890 --> 01:05:08.370
But yeah, I just wanted to call that out.

01:05:08.370 --> 01:05:11.930
I didn't mention it earlier, but IPQ40, like what the heck is that?

01:05:11.930 --> 01:05:18.150
It's the name, it's the type of chipset that's on this thing, type of processor.

01:05:18.150 --> 01:05:20.550
So cool.

01:05:21.570 --> 01:05:24.910
Well, really appreciate everyone, if that's all the questions.

01:05:26.510 --> 01:05:32.290
Not sure if there's any more, but we're good to go, right on time.

01:05:32.710 --> 01:05:35.850
Yeah, Jonathan, do you see anything else in the Twitch we might have missed?

01:05:36.730 --> 01:05:37.790
I'm taking a look here.

01:05:37.790 --> 01:05:42.630
I do see that in Zoom, someone asks, it looks like it identified the attached flash as well.

01:05:42.630 --> 01:05:47.050
So I guess from the U-Boot output there, it identifies the flash.

01:05:47.490 --> 01:05:49.870
Pulling up Twitch, I think from Twitch, we're also good to go.

01:05:49.870 --> 01:05:57.590
So the last question, I guess, was there and the question was, it looks like it identified the type of flash.

01:05:57.590 --> 01:06:00.330
And that might be kind of equally a statement as it is a question.

01:06:00.330 --> 01:06:00.690
It did.

01:06:00.690 --> 01:06:05.350
It identified the one of the flash chips.

01:06:08.170 --> 01:06:16.270
So could you actually from that booted kernel potentially get to those current chips?

01:06:16.270 --> 01:06:18.190
Yeah, it's highly possible.

01:06:18.350 --> 01:06:22.290
You may have to do some manipulation.

01:06:22.290 --> 01:06:23.910
I haven't tried it yet.

01:06:23.910 --> 01:06:32.890
But typically, the easiest way is to build it into the device tree for the kernel that you're building for that processor.

01:06:32.890 --> 01:06:34.810
That's the most effective way.

01:06:34.810 --> 01:06:53.090
Once that's built in there, it makes it 10 times easier for gaining access and basically altering this data or extracting that data off there versus not necessarily have to figure out how do I access a chip when I don't have a device tree for it.

01:06:53.090 --> 01:06:55.050
It's going to be very difficult.

01:06:55.050 --> 01:06:56.050
So yeah.

01:07:00.870 --> 01:07:09.630
Sorry, I had someone that was playing the Linkin Park at the full capacity of the volume there.

01:07:09.630 --> 01:07:11.930
So I apologize as I drove by.

01:07:12.010 --> 01:07:17.210
Okay, yeah, you have one person out there says you need to put that cowboy hat on behind you.

01:07:17.410 --> 01:07:20.490
So you look like Billy Ray Cyrus.

01:07:27.010 --> 01:07:29.870
Oh, y'all are cracking me up.

01:07:29.870 --> 01:07:31.110
Oh, man.

01:07:31.110 --> 01:07:32.210
I appreciate y'all.

01:07:32.210 --> 01:07:33.670
Yeah, let's see what we got.

01:07:33.950 --> 01:07:35.290
Here we go.

01:07:35.550 --> 01:07:36.650
Hats on.

01:07:37.410 --> 01:07:39.330
We have to take this off.

01:07:40.670 --> 01:07:42.050
But there we go.

01:07:42.050 --> 01:07:43.910
We're locked and loaded now.

01:07:45.570 --> 01:07:46.930
Pretty great.

01:07:47.090 --> 01:07:50.030
This is how you find the real bones.

01:07:53.970 --> 01:07:55.070
Nice.

01:07:56.730 --> 01:08:02.330
I mean, the people in the audience, unless the presenters need to leave, we still have time.

01:08:03.270 --> 01:08:07.030
There's no rush to close out quite yet.

01:08:07.890 --> 01:08:11.610
There's 30 minutes before next talk comes on.

01:08:11.610 --> 01:08:19.030
So we still have just a little bit of time probably we could do another five minutes if the presenters are still available.

01:08:19.550 --> 01:08:23.530
Hey, let me go ahead and let me go ahead and boot my failure.

01:08:25.710 --> 01:08:27.770
So let's switch over to that.

01:08:30.450 --> 01:08:32.950
So let me go ahead and share my screen.

01:08:32.950 --> 01:08:34.170
Let's get that going.

01:08:37.290 --> 01:08:40.170
Okay, hopefully everyone can see everything fine now.

01:08:40.830 --> 01:08:42.370
So let's go ahead and power this.

01:08:42.370 --> 01:08:43.830
Watch this thing fail again.

01:08:44.770 --> 01:08:49.890
I should know when to walk away to a demo failure.

01:08:50.070 --> 01:08:52.770
So let's go ahead and stop here real quick.

01:08:52.770 --> 01:08:55.010
Let's go print environment.

01:08:55.010 --> 01:08:57.250
So we can see what I altered.

01:08:57.250 --> 01:09:00.170
So I altered standard boot.

01:09:00.430 --> 01:09:05.570
When I copied it over, I missed this word right here, board equals.

01:09:05.570 --> 01:09:08.970
So it ended up specifying this board.

01:09:08.970 --> 01:09:18.690
And what's kind of strange is often when you do boot args, and I've mistyped things before, I'd never had it cause a kernel panic like that before.

01:09:18.690 --> 01:09:19.810
So it's kind of interesting.

01:09:19.810 --> 01:09:24.450
I've had it just skip over that functionality or whatever.

01:09:24.450 --> 01:09:25.750
So that was kind of interesting.

01:09:26.210 --> 01:09:42.250
So the change I did this originally said null, we're able to identify with a little legwork watching the system normally boot up, looking at some of that stuff, identify the type of TTY and replace the console null out of there.

01:09:42.250 --> 01:09:42.350
So

01:10:02.630 --> 01:10:14.290
it's common to see these options also on devices that are outside of the U-boot where it says press F key, enter into failsafe mode.

01:10:14.290 --> 01:10:20.330
Sometimes these will put you into a single user mode when the vendor's crazy enough to leave them available.

01:10:20.330 --> 01:10:27.870
Something to think about from when you're watching a boot option, it's not part of the U-boot stuff, but it can be very helpful.

01:10:27.870 --> 01:10:31.170
It will put you in a very locked down system.

01:10:31.170 --> 01:10:36.650
There won't be network, there won't be device drivers, there won't be nothing on there.

01:10:36.750 --> 01:10:38.590
So inherently, there you go.

01:10:38.590 --> 01:10:41.870
So instantly you're able to get past that.

01:10:41.870 --> 01:10:57.770
And like I said, this is kind of a common issue that you can run into a number of times where they've just basically said, turn the console off before you boot kernel or turn the console off when kernel, before kernel runs.

01:10:57.790 --> 01:11:00.690
And because of that, you don't get a console.

01:11:00.690 --> 01:11:11.630
If you can gain access to U-boot, probably eight out of 10 times, you can change those settings to be able to gain access to a console.

01:11:11.630 --> 01:11:17.870
Now, whether you'll have full root access after boot is to be found or figured out.

01:11:17.870 --> 01:11:31.190
But believe it or not, I think over the last so many years, I've encountered three or four devices that had it set up to go ahead and halt the console so you can have it.

01:11:31.190 --> 01:11:39.250
And when I changed the argument so the console was enabled, at least half the time, I had a full root console at that point.

01:11:39.550 --> 01:11:46.570
And these settings here that I mentioned, the press one, two, just select the debug mode.

01:11:46.870 --> 01:11:48.550
Never had much luck with those.

01:11:48.550 --> 01:11:50.950
Sometimes they do things, sometimes they don't.

01:11:50.950 --> 01:11:54.610
But the F key, if you ever see that, takes you to failsafe mode.

01:11:54.610 --> 01:12:04.050
This will give you root level access, but it's amazing how complicated with root level access and no ability to move data on or out of the device.

01:12:04.050 --> 01:12:10.770
It's doable, but it becomes very problematic because often you actually have to build the device nodes.

01:12:10.770 --> 01:12:16.770
And if they harden the device and turn certain programs off and remove them, it becomes more difficult.

01:12:17.070 --> 01:12:24.250
From the Luma, just out of curiosity from the Luma, this had this and I was working to try to get data off of it.

01:12:24.250 --> 01:12:45.190
In a way I originally did it was go into the F mode and actually build, manually build all the device, not totally manually, but very close to manually reconstruct the device nodes, naming them all the correct pieces and parts to build a USB.

01:12:45.210 --> 01:12:48.250
And then from there was able to move the data off to the USB.

01:12:48.310 --> 01:12:50.250
Just some stuff to think about.

01:12:52.370 --> 01:12:54.170
A small question just came up, Daryl.

01:12:54.170 --> 01:12:57.710
I know you had mentioned this yesterday during your building the IoT lab.

01:12:57.710 --> 01:13:00.910
What is your FTDI device you're using for that one?

01:13:00.910 --> 01:13:02.310
Its name escapes me.

01:13:02.310 --> 01:13:03.770
Someone was asking on Twitch.

01:13:03.950 --> 01:13:06.250
Oh, gosh, this one I have right here.

01:13:06.590 --> 01:13:12.270
Yeah, it was that cool one that could do like more than just it had like it supported like SPI and others in addition to UART.

01:13:18.140 --> 01:13:19.880
Yeah, that's the one.

01:13:20.400 --> 01:13:22.240
Let's power this off.

01:13:22.320 --> 01:13:25.420
Let's see if this has this name, has a name on it.

01:13:25.420 --> 01:13:27.640
I don't know if this even has a name.

01:13:27.640 --> 01:13:31.400
It's very generic and I do not even have the box for it anymore.

01:13:31.400 --> 01:13:33.660
I bought this off Amazon.

01:13:33.720 --> 01:13:44.280
All I did was search for multi UART connector or multi port UART connector and this came up.

01:13:44.280 --> 01:13:49.280
If I remember the price of this was like twenty seven dollars.

01:13:50.800 --> 01:13:55.500
But to to the life of me, I do not know the name.

01:13:55.500 --> 01:14:03.520
This is a generic build device coming out of China and it works pretty good.

01:14:03.520 --> 01:14:05.540
So cool.

01:14:05.540 --> 01:14:11.100
But sadly, I do not know what its name is or who makes it.

01:14:11.100 --> 01:14:11.820
Gotcha.

01:14:11.860 --> 01:14:13.600
Another question cropped up.

01:14:13.800 --> 01:14:24.420
Is there a URL or GitHub of some type where one could get ROMs to access a processor or access to a processor to play around with and do this type of stuff?

01:14:26.420 --> 01:14:43.580
I think they're asking, is there, I guess, any like I guess I think I think what's being asked with it is are there maybe like a list of devices that that could be purchased in order to do things such as U-Boot exploitation?

01:14:44.560 --> 01:14:58.340
I would actually literally exactly what Garrett said, go to go on to eBay and look at buying some of the devices on eBay.

01:14:58.780 --> 01:15:00.160
I think would be bright.

01:15:00.160 --> 01:15:01.480
You get the Lumos.

01:15:01.580 --> 01:15:06.640
You can get the you can go ahead and get the Hughes out there.

01:15:06.640 --> 01:15:09.940
He actually had a screen where he was showing some that were available.

01:15:10.020 --> 01:15:11.880
They're not expensive.

01:15:11.980 --> 01:15:13.780
I'm not sure how this would work.

01:15:13.780 --> 01:15:19.820
This is a product that that I was playing around with just recently, and it's like 19 or 20 bucks.

01:15:19.820 --> 01:15:24.880
And basically, it has OpenWRT running on it right now.

01:15:24.880 --> 01:15:26.960
It has serial connections.

01:15:27.020 --> 01:15:34.820
There's a flash chip so you can practice pulling the chip off if you want reading it or using SPI chip reading techniques.

01:15:35.040 --> 01:15:40.520
You can probably trace out versus some of these headers or connectors.

01:15:40.520 --> 01:15:47.440
You may be able to trace out the actual JTAGs on this for the chip.

01:15:47.440 --> 01:15:49.240
It has Ethernet.

01:15:49.240 --> 01:15:50.640
It has Wi-Fi.

01:15:50.640 --> 01:15:52.320
It has USB.

01:15:52.460 --> 01:15:55.220
And literally, it's like 20 bucks.

01:15:55.320 --> 01:16:01.240
So this would be an easy, cheap device to possibly play with.

01:16:01.240 --> 01:16:01.880
And that's

01:16:05.840 --> 01:16:08.900
Vixby 300 wireless travel router.

01:16:09.100 --> 01:16:11.580
I would try playing around with that.

01:16:11.580 --> 01:16:20.300
But I have to admit, this was kind of footsy when it came to the actual U-boot arguments.

01:16:20.300 --> 01:16:24.140
I had a couple arguments that didn't work, and I couldn't alter and stuff like that.

01:16:24.260 --> 01:16:25.620
Here's another device.

01:16:25.620 --> 01:16:27.600
I think it's the exact same product.

01:16:27.600 --> 01:16:29.220
They're just white-labeled different.

01:16:29.660 --> 01:16:35.640
GL-iNet and Mini Smart Router also has all the same functions and features on it.

01:16:35.640 --> 01:16:39.840
I'm not sure if the Mango is still on the market.

01:16:39.840 --> 01:16:41.960
May be able to buy one used.

01:16:45.080 --> 01:16:58.880
But a lot of these cheap devices are out there, and it gives you a chance to experiment with UART and JTAG and SPI chips and sometimes NAND chips and flash chips.

01:16:58.880 --> 01:17:02.920
I mean, the list goes on and on and on, and they're often cheap.

01:17:04.420 --> 01:17:13.100
Like I said, Luma I like a lot because it has all of those same features, and you can get them for 20-30 bucks used.

01:17:13.420 --> 01:17:14.940
It has the USB.

01:17:14.940 --> 01:17:16.360
It has the Ethernet.

01:17:16.360 --> 01:17:18.920
It has UART connectivity.

01:17:19.000 --> 01:17:22.440
It has NAND flash chips on the device.

01:17:22.440 --> 01:17:28.680
It has SOIC8 SPI flash memory chips on the device.

01:17:28.680 --> 01:17:34.160
So it's a perfect platform for hacking, attacking, experimenting.

01:17:34.160 --> 01:17:37.940
The pin glitch works on it also as an example.

01:17:42.610 --> 01:17:43.610
Awesome.

01:17:43.810 --> 01:17:45.450
I was just catching up in the chat.

01:17:45.450 --> 01:17:49.350
It was a F-E-I-T, however you pronounce that.

01:17:49.350 --> 01:17:58.770
It was a fight bulb that I had from Costco that I just decided to put and leave in the drawer because just didn't feel very secure about it.