Hacker's Guide to UART Root Shells

Learn tricks and techniques like these, with us, in our amazing training courses!

The UART Protocol and Interface is crucial for hacking IoT devices. We explain how to quickly identify a UART interface and connect to it to get a root shell, as well as a trick on how to re-enable a UART connector that has been disabled by the manufacturer.

00:00 Intro
01:00 What is UART?
04:05 Identifying UART
07:56 Connecting to UART
08:52 The UART Protocol
14:42 Re-enabling broken UART

Did you enjoy this video? Then follow us on Twitter, and subscribe to our channel for more awesome hacking videos.

~ Flashback Team

[jonathanbouchard]

Keep up the videos very awesome! For someone new to hardware hacking what cheap devices could I try my hands on that has an UART interface?

[dev-debug]

I'm lazy so I just usually try 9600, 19200 or 115200, works 99% of the time and is faster than reversing the baud rate. Of course for an educational video showing how you can calculate the baud rate is very good. Great video !

[Clawthorne]

I had never considered before that you could take photos of both sides of the PCB and color traces in a photo editor. That's such a great idea!

[untermench]

In 1990, I built from scratch a few micro controllers and communicated with them using a serial interface and a terminal to configure them. This video brings back old memories and makes me glad that people are using the same technique.

[yuri]

Hollywood Hacker: "I'm in the mainframe!"
Real world hacker: paperclip bridge

[altimmons]

Please keep doing these. I’m trying very hard to learn to do stuff like this, I literally have all the gear. But either I’m slogging through textbooks that are too boring to read, just poking around under the microscope and multimeter or with uart to usb, reading tutorials for already wide open -eg dev boards and generally struggling.

[PlaceholderforBjorn]

Wow, impressive how you tought me serial communication in 17minutes when I have had quite hard to grasp it before.
Very educational approch with practical example, and problem solving.
Subscribed!

[StarsManny]

If I wanted to show someone an example of what a well presented, entertaining YouTube video looks like, I would show them this channel.

[evanlane]

This is an example of a perfect tutorial. Great pace, background info, and real-world examples. Thanks so much! Subscribed.

[harshtiwari]

Simply brilliant. Thank you for explaining the concept of calculating the baud rate so beautifully.

[seancondon]

7:20 - In most cases, which pin is the ground should be readily apparent. Usually all but one of them will have small traces connected. The one that has a large, wide trace is going to be the ground. Some PCBs, however, have a certain degree of protection by making the traces less visible. On those, a multimeter with continuity would be a necessity. This board is not one of those, as you can visibly see the North pin and the 2 South pins have small traces, and the odd one out is connected to the Board Common Ground. This works for simpler PCBs. It is the more complex ones - where the ground is less obvious - where you need to use this method.

[PCMrTrickster]

You can also use well known 'screen' command instead of 'minicom'. Screen is usually used to create background sessions but also has functionality to support configurable serial connections.

[mheermance]

This was interesting and informative. One small nit. I've always heard this called asynchronous serial protocol, and the UART is the hardware component that emits the protocol.

[jonathanlein]

Very cool video. I just got my first root shell on an old Wi-fi range extender I had lying around.

[greywolf]

One thing to note about baud rate is that the whole number integer values are not the only values you can use. There are fractional rates that are available, depending on the CLK frequency. Look up any of the older UART ICs and you should find the info.

[sauravmodak]

Never seen anyone teaching something so easily! Love this thank you sir

[GeorgeBoudouris]

This is the best tutorial i have seen about usb to ttl.
Thank you so much man for the help

[ryanreedgibson]

This video should be what youtube is all about. GREAT WORK teaching!

[Uneke]

A lot of the times, the manufacturer will have vcc connected to ground on the board which is what locks hart down and makes it read only.
By disconnecting them with a small tear (micro grinder works well for this so you can do repairs later) you open it up to read/write.

This is not for all of them, but it is a cheap and effective way that they do, do it.

[aazjo]

Thanks for documenting this. I got a root shell on my Archer C9 back in 2016 with the same simple UART interface.