Automated debug interface identification tool.

Opening Framing

The Physical Attack Vector: In the previous weeks, we looked at firmware as a file. But firmware lives on silicon. Secure Boot, disk encryption, and OS hardening often rely on the assumption that the hardware is trusted and immutable.

Why This Matters: Hardware hacking shatters this assumption. By attaching wires to test points, attackers can interrupt the boot process, dump secrets from RAM, or glitch the CPU into skipping password checks. If you can physically access a device, you are rarely more than $50 of equipment away from root access including techniques developed by NSA's ANT division (implants) to hobbyist bypassing of game console security.

Real-World Relevance: The PlayStation 3 Jailbreak was achieved by a simple voltage glitch on a memory line. ATM "skimmers" and "jackpotting" attacks often involve plugging into internal USB or serial ports hidden behind a plastic bezel.

1) Tools of the Trade: Setting Up Your Lab

Hardware hacking requires a physical toolkit. You don't need thousands of dollars; a $50 kit can compromise 90% of consumer IoT devices.

Essential Hardware

The Software Stack

You will need a Linux environment (Kali or Ubuntu) with specific drivers.

sudo apt update
sudo apt install flashrom openocd minicom pulseview sigrok-cli binwalk

# Permissions Setup (Udev rules)
# Often required to access USB devices without sudo
wget https://git.io/openocd-udev -O /etc/udev/rules.d/99-openocd.rules
sudo udevadm control --reload

2) PCB Reconnaissance

The first step in any hardware engagement is high-resolution photography and component identification. You must understand what you are looking at before you apply power.

Anatomy of a PCB

COMPONENT IDENTIFICATION GUIDE:

┌───────────────────────────────────────┐
│ [ POWER SECTION ]                     │
│ - Fat traces (high current)           │
│ - Large capacitors (cylinders)        │
│ - Inductors (coils/squares)           │
│ - Voltage Regulators (3-pin + tab)    │
│ -> GOAL: Find 3.3V, 5V, and GND       │
└───────────────────────────────────────┘

┌───────────────────────────────────────┐
│ [ LOGIC SECTION ]                     │
│ - SoC/CPU (Largest BGA chip)          │
│ - RAM (DDR) near CPU (Length matched) │
│ - Flash (8-pin SPI or 48-pin TSOP)    │
│ -> GOAL: Identify Architecture        │
└───────────────────────────────────────┘

┌───────────────────────────────────────┐
│ [ DEBUG INTERFACES ]                  │
│ - 4-pin headers (UART)                │
│ - 10/14/20-pin headers (JTAG)         │
│ - Unpopulated solder pads             │
│ -> GOAL: Identify Root Shell access   │
└───────────────────────────────────────┘

Datasheet Hunting

Every chip has a unique marking. Google is your primary tool.

• Search Query: "PartNumber + datasheet" (e.g., "STM32F103 datasheet").
• Pinout Diagram: Find the "Pin Definition" table. Look for pins labeled TX, RX, TMS, TCK, DO, CLK.
• Tracing Traces: Use a multimeter in "Continuity Mode" to beep out where the chip pins go. If Pin 4 is TX, and it connects to a test pad on the board, that pad is your target.

3) UART Access (The Root Console)

UART (Universal Asynchronous Receiver/Transmitter) is the "standard out" for embedded systems. Developers use it to see boot logs. Hackers use it to interrupt the boot process.

Identifying the Pinout

You typically find a row of 3 or 4 pins (VCC, GND, TX, RX).

Connecting & Interacting

Use a USB-to-TTL Adapter (FTDI/CH340). CROSS THE STREAMS: Your TX goes to their RX. Your RX goes to their TX.

Exploit: By changing `bootargs` to `init=/bin/sh`, we tell the kernel to launch a root shell instead of the normal init system. This bypasses login passwords entirely.

4) SPI Flash Extraction

If UART is locked or silent, we go directly for the brain storage: the SPI Flash chip.

The Hardware

• Chip: Usually an 8-pin SOIC chip (Winbond, Macronix).
• Tool: CH341A Miniprogrammer (The "Universal" cheap tool) or a Bus Pirate.
• Interface: SOIC-8 Clip (Pomona Clip) allows reading without desoldering.

The Process (In-Circuit Programming - ICP)

You attach the clip to the chip while it is soldered to the board.

# 1. Detect the chip
sudo flashrom -p ch341a_spi

# Output: Found Winbond flash chip "W25Q64" (8192 kB, SPI).

# 2. Dump firmware (DO IT TWICE!)
sudo flashrom -p ch341a_spi -r dump1.bin
sudo flashrom -p ch341a_spi -r dump2.bin

# 3. Verify integrity
md5sum dump1.bin dump2.bin
# If hashes match, you have a good dump. If not, check connections.

5) JTAG & SWD (God Mode)

JTAG (Joint Test Action Group) is an industry standard for testing PCBs. For hackers, it is a hardware debugger interface that lets you control the CPU core directly.

Capabilities

• Halt Execution: Stop the CPU at any instruction.
• Read/Write RAM: Dump encryption keys from memory while they are in use.
• Breakpoints: Set hardware breakpoints on memory access (e.g., "Pause when address 0x1234 is read").

Tools of the Trade

OPENOCD SESSION EXAMPLE:

$ openocd -f interface/jlink.cfg -f target/stm32f4x.cfg
...
Info: stm32f4x.cpu: hardware has 6 breakpoints, 4 watchpoints

$ telnet localhost 4444
> reset halt
target halted due to debug-request, current mode: Thread 
xPSR: 0x01000000 pc: 0x08000134 msp: 0x20000400

> dump_image ram_dump.bin 0x20000000 0x10000
(Dumps 64KB of RAM to disk)

6) Case Study: Hacking the "HomeRouter X"

Let's walk through a complete hardware engagement from unboxing to root shell.

Phase 1: Entry

You pry open the router. You see a 4-pin header near the CPU.

1. Multimeter Check: Pin 1 is GND. Pin 4 is 3.3V. Pin 2 is steady 3.3V (RX). Pin 3 fluctuates (TX).
2. Calculated Guess: This is UART. The Baud rate is unknown.
3. Tooling: Use a Logic Analyzer ($10) on Pin 3. Pulse width suggests 115200 baud.
4. Connection: USB-TTL adapter connected. Screen session opened.

Phase 2: The Obstacle

You mash "Enter" and get a prompt: Password:. Common passwords (admin/admin, root/root) fail. The UART is password protected.

Phase 3: The Bypass

You notice the boot logs mention "U-Boot 1.1.4". You reboot the router and immediately mash keys again during the "Hit any key to stop autoboot" countdown.
Success! Alternatively, you can glitch the data line of the External Flash chip to corrupt the bootloader's "password text," causing it to fallback to a default or crash into a shell. You drop into the U-Boot shell =>.

Phase 4: Persistence

From U-Boot, you modify the kernel command line: setenv bootargs "console=ttyS0,115200 root=/dev/mtdblock2 init=/bin/sh". You boot. The kernel loads, mounts the filesystem, and instead of asking for a password, it gives you a root shell #. You dump /etc/shadow and crack the hash for later remote access.

7) Advanced: Fault Injection (Glitching)

If the software is secure (signed bootloader), and the debug ports are disabled (JTAG fused), how do you get in? You break the physics of the chip.

Voltage Glitching

At the exact moment the CPU checks a password or signature: if (signature_valid) ... You verify quickly drop the core voltage (VCC) to 0.5V and bring it back up.

The CPU might fail to execute the "Compare" instruction or skip the "Branch if Equal" instruction, falling through to the "Access Granted" code path. This breaks Secure Boot chains and Password checks on unpatchable ROM code.

import chipwhisperer as cw

# Connect to hardware
scope = cw.scope()
target = cw.target(scope)

# Loop to find the glitch
for width in range(1, 40):
    for offset in range(1, 100):
        scope.glitch.width = width
        scope.glitch.offset = offset
        
        # Trigger glitch
        scope.arm()
        target.reset()
        
        # Check result
        output = target.read()
        if "Welcome Root" in output:
            print(f"GLITCH SUCCESS at width {width}, offset {offset}")
            break

8) Defensive Hardware Architecture

How do we design hardware to resist these attacks?

Guided Lab: Protocol Analysis

Objective: Analyze a captured logic analyzer trace of a secure boot process.

Scenario: You attached a logic analyzer to a suspicious chip. Decode the traffic.

Part 1: Setup Logic 2 (Saleae)

1. Download "Saleae Logic 2" software (works without hardware in demo mode).
2. Load the provided capture file `boot_capture.sal`.

Part 2: SPI Decoding

1. Identify the Channels: CLK (Clock), MOSI (Master Out), MISO (Master In), CS (Select).
2. Add an SPI Analyzer.
3. Task: Find the ASCII string "U-Boot" in the MISO channel. This demonstrates the CPU reading the bootloader from Flash.

Part 3: UART Decoding

1. Find the channel that is "High" most of the time but dips low occasionally.
2. Add a Async Serial analyzer.
3. Challenge: You don't know the Baud Rate. Use the "Auto-Baud" feature or measure the width of the shortest pulse (1 bit duration).
   Hint: If pulse is 8.68 microseconds, Baud = 1 / 0.00000868 ≈ 115200.

Building on Prior Knowledge

Hardware hacking relies heavily on the protocols you learned in CSY202.

Outcome Check

• Analyze PCB to identify components and debug interfaces
• Connect to UART and obtain shell access
• Explain JTAG/SWD capabilities and limitations
• Read SPI flash using in-circuit techniques
• Select appropriate tools for hardware testing budget
• Decode logic analyzer captures involving UART and SPI

Resources & Equipment

Glossary of Terms

UART

Universal Asynchronous Receiver/Transmitter. Serial communication protocol used for console access.

Baud Rate

The speed of data transmission in symbols per second (e.g., 115200 is fast, 9600 is slow).

JTAG

Joint Test Action Group. A debugging standard used to test PCBs and debug chips.

SPI

Serial Peripheral Interface. High-speed synchronous protocol used for Flash memory storage.

Glitching

Injecting faults (voltage/clock) to cause the CPU to skip instructions or behave unpredictably.