Shmoocon 2016: Reverse Engineering Cheap Chinese Radio Firmware

January 19, 2016 by Brian Benchoff 128 Comments

Every once in a great while, a piece of radio gear catches the attention of a prolific hardware guru and is reverse engineered. A few years ago, it was the RTL-SDR, and since then, software defined radios became the next big thing. Last weekend at Shmoocon, [Travis Goodspeed] presented his reverse engineering of the Tytera MD380 digital handheld radio. The hack has since been published in PoC||GTFO 0x10 (56MB PDF, mirrored) with all the gory details that turn a $140 radio into the first hardware scanner for digital mobile radio.

The Tytera MD380 is a fairly basic radio with two main chips: an STM32F405 with a megabyte of Flash and 192k of RAM, and an HR C5000 baseband. The STM32 has both JTAG and a ROM bootloader, but both of these are protected by the Readout Device Protection (RDP). Getting around the RDP is the very definition of a jailbreak, and thanks to a few forgetful or lazy Chinese engineers, it is most certainly possible.

The STM32 in the radio implements a USB Device Firmware Upgrade (DFU), probably because of some example code from ST. Dumping the memory from the standard DFU protocol just repeated the same binary string, but with a little bit of coaxing and investigating the terrible Windows-only official client application, [Travis] was able to find non-standard DFU commands, write a custom DFU client, and read and write the ‘codeplug’, an SPI Flash chip that stores radio settings, frequencies, and talk groups.

Further efforts to dump all the firmware on the radio were a success, and with that began the actual reverse engineering of the radio. It runs an ARM port of MicroC/OS-II, a real-time embedded operating system. This OS is very well documented, with slightly more effort new functions and patches can be written.

In Digital Mobile Radio, audio is sent through either a public talk group or a private contact. The radio is usually set to only one talk group, and so it’s not really possible to listen in on other talk groups without changing settings. A patch for promiscuous mode – a mode that puts all talk groups through the speaker – is just setting one JNE in the firmware to a NOP.

The Tytera MD-830 ships with a terrible Windows app used for programming the radio — The Tytera MD-380 ships with a terrible Windows app used for programming the radio

With the help of [DD4CR] and [W7PCH], the entire radio has been reverse engineered with rewritten firmware that works with the official tools, the first attempts of scratch-built firmware built around FreeRTOS, and the beginnings of a very active development community for a $140 radio. [Travis] is looking for people who can add support for P25, D-Star, System Fusion, a proper scanner, or the ability to send and receive DMR frames over USB. All these things are possible, making this one of the most exciting radio hacks in recent memory.

Before [Travis] presented this hack at the Shmoocon fire talks, intuition guided me to look up this radio on Amazon. It was $140 with Prime, and the top vendor had 18 in stock. Immediately after the talk – 20 minutes later – the same vendor had 14 in stock. [Travis] sold four radios to members of the audience, and there weren’t that many people in attendance. Two hours later, the same vendor had four in stock. If you’re looking for the best hardware hack of the con, this is the one.

Why No Plane Parachutes? And Other Questions.

January 19, 2016 by Nava Whiteford 54 Comments

This week I was approached with a question. Why don’t passenger aircraft have emergency parachutes? Whole plane emergency parachutes are available for light aircraft, and have been used to great effect in many light aircraft engine failures and accidents.

But the truth is that while parachutes may be effective for light aircraft, they don’t scale. There are a series of great answers on Quora which run the numbers of the size a parachute would need to be for a full size passenger jet. I recommend reading the full thread, but suffice it to say a ballpark estimate would require a million square feet (92903 square meters) of material. This clearly isn’t very feasible, and the added weight and complexity would no doubt bring its own risks.

Continue reading “Why No Plane Parachutes? And Other Questions.” →

Naviator Drone Uses Its Propellers To Fly And Swim

January 18, 2016 by Gerrit Coetzee 40 Comments

Rutgers University just put out a video on a “drone” that can fly and then drop into a body of water, using its propellers to move around. This isn’t the first time we’ve covered a university making sure Skynet can find us even in the bathtub, but this one is a little more manageable for the home experimenter. The robot uses a Y8 motor combination. Each motor pair on its four arms spin in opposite directions, but provide thrust in the same direction. Usually this provides a bit more stability and a lot more redundancy in a drone. In this case we think it helps the robot leave the water and offers a bit more thrust underwater when the props become dramatically less efficient.

We’re excited to see where this direction goes. We can already picture the new and interesting ways one can lose a drone and GoPro forever using this, even with the integral in your toolbox. We’d also like to see if the drone-building community can figure out the new dynamics for this drone and release a library for the less mathematically inclined to play with. Video after the break.

Continue reading “Naviator Drone Uses Its Propellers To Fly And Swim” →

Up Your Tiny House Game With Stone Age Hacks

January 18, 2016 by Dan Maloney 63 Comments

Bare feet, bare hands, and bare chest – if it weren’t for the cargo shorts and the brief sound of a plane overhead, we’d swear the video below was footage that slipped through a time warp. No Arduinos, no CNC or 3D anything, but if you doubt that our Stone Age ancestors were hackers, watch what [PrimitiveTechnology] goes through while building a tile-roofed hut with no modern tools.

The first thing we’ll point out is that [PrimitiveTechnology] is not attempting to be (pre-)historically accurate. He borrows technology from different epochs in human history for his build – tiled roofs didn’t show up until about 5,000 years ago, by which time his stone celt axe would have been obsolete. But the point of the primitive technology hobby is to build something without using any modern technology. If you need a fire, you use a fire bow; if you need an axe, shape a rock. And his 102 day build log details every step of the way. It’s fascinating to watch logs, mud, saplings, rocks and clay come together into a surprisingly cozy structure. Especially awesome if a bit anachronistic is the underfloor central heating system, which could turn the hut into a lovely sauna.

Primitive technology looks like a fascinating hobby with a lot to teach us about how we got to now. But if you’re not into grubbing in the mud, you could always 3D print a clay hut. We’re not sure building an enormous delta-bot is any easier, though.
Continue reading “Up Your Tiny House Game With Stone Age Hacks” →

Running Calculus On An Arduino

January 18, 2016 by Will Sweatman 39 Comments

It was Stardate 2267. A mysterious life form known as Redjac possessed the computer system of the USS Enterprise. Being well versed in both computer operations and mathematics, [Spock] instructed the computer to compute pi to the last digit. “…the value of pi is a transcendental figure without resolution” he would say. The task of computing pi presents to the computer an infinite process. The computer would have to work on the task forever, eventually forcing the Redjac out.

Calculus relies on infinite processes. And the Arduino is a (single thread) computer. So the idea of running a calculus function on an Arduino presents a seemingly impossible scenario. In this article, we’re going to explore the idea of using derivative like techniques with a microcontroller. Let us be reminded that the derivative provides an instantaneous rate of change. Getting an instantaneous rate of change when the function is known is easy. However, when you’re working with a microcontroller and varying analog data without a known function, it’s not so easy. Our goal will be to get an average rate of change of the data. And since a microcontroller is many orders of magnitude faster than the rate of change of the incoming data, we can calculate the average rate of change over very small time intervals. Our work will be based on the fact that the average rate of change and instantaneous rate of change are the same over short time intervals.

Continue reading “Running Calculus On An Arduino” →

What’s In A Tool? A Case For Made In USA.

January 18, 2016 by Gerrit Coetzee 253 Comments

A lot of people make the argument that you can’t go wrong buying a tool made in USA, Germany, Japan, Switzerland, etc. They swear that any Chinese tool will be garbage and it’s not worth purchasing them. Now, any discerning mind will say, “Wait a minute, why? China has a huge economy, experienced people, and the ability to use all the scary chemicals that make the best steel. Why would their tools be any better or worse than ours?” It’s a very valid argument. There are lots of Chinese tools that are the best in the world. Most of what we see in our stores are not. So what is the difference. Why does a country who can make the best tools not make the best tools? Surely it isn’t purely cost cutting. Is it cultural? The opinion I wish to put forth is that it’s a matter of design intent communication.

I’ve worked as an engineer in industry. The one common thread between a quality product and a bad product has always been this, ”Is the person who designed the product involved in making the product?” If the person or peoples who imbued the design intent into the original product are actively involved in and working towards the execution of that product, that product has a vastly greater chance of being good. Or in other words: outsourcing doesn’t produce a bad product because the new people making the product don’t care. It makes a bad product because the people who understand the intent behind the product are separated from its execution.

As you can see the export made crescent wrench is not made to the same tolerances as the previous wrench.

Let’s take the Crescent wrench as an example. Crescent wrenches used to be made in USA. In the past few years they have begun to make them in China. We can spot many visual differences right away. The new Crescent wrench has a different shape, the logo has changed and the stamping for the logo is dodgy, and worse, the tool just doesn’t operate as well as it used to. The jaws aren’t as hard and they wiggle more. What happened? How could Crescent mess up their flagship so badly. Surely they intended just to cut costs, not to reduce quality. This isn’t shameful in itself

What happened to the Crescent wrench is easily explained by anyone who has seen a product from design to execution before. A factory in the USA set out to make a good adjustable wrench. Hundreds of engineers and employees worked in a building to make a good wrench. When their machines didn’t work, they came up with solutions. When their quality was lacking, they implemented better processes. They had a list of trusted suppliers. They could guarantee that the materials that came in would be imbued with their vision and intent when the product came out. The intent and will of all those people built up in one place over time.

Continue reading “What’s In A Tool? A Case For Made In USA.” →

Emulating And Cloning Smart Cards

January 18, 2016 by Brian Benchoff 33 Comments

A few years ago, we saw a project from a few researchers in Germany who built a device to clone contactless smart cards. These contactless smart cards can be found in everything from subway cards to passports, and a tool to investigate and emulate these cards has exceptionally interesting implications. [David] and [Tino], the researchers behind the first iteration of this hardware have been working on an improved version for a few years, and they’re finally ready to release it. They’re behind a Kickstarter campaign for the ChameleonMini, a device for NFC security analysis that can also clone and emulate contactless cards.

While the original Chameleon smart card emulator could handle many of the contactless smart cards you could throw at it, there at a lot of different contactless protocols. The new card can emulate just about every contactless card that operates on 13.56 MHz.

The board itself is mostly a PCB antenna, with the electronics based on an ATXMega128A4U microcontroller. This micro has AES and DES encryption engines, meaning if your contactless card has encryption and you have the cryptographic key, you can emulate that card with this device. They’re also making a more expensive version that also has a built-in reader that makes the ChameleonMini a one-stop card cloning tool.