Shmoocon 2017: On Not Reverse Engineering Through Emulation

Right now, I’m at Shmoocon, and it’s living up to all expectations. That’s a tall order — last year, the breakout talk was from [Travis Goodspeed] on his efforts to reverse engineer the firmware for a cheap Chinese radio. Four people in the room for that talk last year bought the radio on Amazon, and now there’s a legitimate open source project dedicated to building firmware and tools to support this radio.

tyteraNow that [Travis] has a few compatriots working on firmware for this radio, he has the same challenges as any other team. The project needs unit tests, and this isn’t easy to do when all the code is locked up inside a radio. Instead of setting up an entire development platform based around a cheap radio, [Travis] came up with a toolchain that’s unlike anything I’ve ever seen. Instead of reverse engineering the firmware for this radio, he’s simply emulating the ARM firmware on the desktop. Development is quick and easy, and he has the live demos to prove it.

The heart of the Tytera radio in question is an STM32F405. This is a pretty common part, and thanks to [Travis]’ work last year, he has all the firmware that ships on this radio. This doesn’t mean he has access to all the radio’s capabilities, though; there’s a black box in the code somewhere that translates .wav files to radio packets and back again. Open sourcing this would usually mean reverse engineering, but [Travis] had a better idea.

Instead of reverse engineering the entire radio, [Travis] is using QEMU to emulate an ARM microcontroller on his desktop, run the relevant code, and completely ignore any actual reverse engineering. Since this radio is already jailbroken and the community has a pretty good idea of where all the functions and subroutines are in the firmware, the most difficult part of pulling this trick off is setting up QEMU.

As a proof of concept, [Travis] downloaded raw AMBE packets from the radio to his laptop. These were then sent through the emulated radio, producing raw audio that was then converted into a .wav file. Effectively, a black box in this radio was emulated, which means [Travis] doesn’t need to know how the black box works.

All the code for this weird emulation / unit test, as well as everything the community has released for this radio is available on the GitHub. A lot of work has gone into the jailbreaking, reverse engineering, and emulation efforts here, making this radio somewhat ironically one of the most open radios you can buy.

Virtually Free Rapsberry Pis

One of the nice things about the Raspberry Pi is that it runs Linux and you can do a lot of development right on the board. The converse of that is you can do a lot of development on a Linux desktop and then move things over to the Pi once you get the biggest bugs out. However, sometimes you really need to run code on the actual platform.

There is, however, an in-between solution that has the added benefit of upping your skills: emulate a Pi on your desktop. If you use Linux or Windows on your desktop, you can use QEMU to execute Raspberry Pi software virtually. This might be useful if you don’t have a Pi (or, at least, don’t have it with you). Or you just want to leverage your large computer to simplify development. Of course we would be delighted to see you build the Pi equivalent of the Tamagotchi Singularity but that’s a bit beyond the scope of this article.

Since I use Linux, I’m going to focus on that. If you insist on using Windows, you can find a ready-to-go project on Sourceforge. For the most part, you should find the process similar. The method I’ll talk about works on Kubuntu, but should also work on most other Debian-based systems, including Ubuntu.

Continue reading “Virtually Free Rapsberry Pis”

Running Debian on a Graphing Calculator

While the ubiquitous TI-83 still runs off an ancient Zilog Z80 processor, the newer TI-Nspire series of graphing calculators uses modern ARM devices. [Ivoah] managed to get Debian Linux running on a TI-Nspire calculator, and has written a guide explaining how it’s done.

The process uses Ndless, a jailbreak which allows code to run at a low level on the device. Ndless also includes a full SDK, emulator, and debugger for developing apps. In this case, Ndless is used to load the Linux kernel.

The root filesystem is built on a PC using debootstrap and the QEMU ARM emulator. This allows you to install whatever packages are needed via apt, before transitioning to the calculator itself.

With the root filesystem on a USB flash drive, Ndless runs the Linux loader, which starts the kernel, mounts the root filesystem, and boots in to a Debian system in about two minutes. As the video after the break demonstrates, this leaves you with a shell on the calculator. We’re not exactly sure what to do with Linux on a graphing calculator, but it is a neat demonstration.

Continue reading “Running Debian on a Graphing Calculator”

Vista on a PS3


Apparently you can run pretty much anything on a PS3. [mopx0] has managed to get Vista running on his PS3. He used Qemu 9.0.1 to install Vista on a PC. He says it takes “about a day or so”, after using Vlite to speed it up, so be patient. You then make an image of the install and copy it to your PS3. Don’t worry though, your hard work will be rewarded by a speedy 25 minute boot time when you’re done.

Even though it is extremely slow, to the point of being nearly unusable, its good to see people pushing the boundaries of our hardware’s intended use.

[via PS3scene]