Chip-Off Firmware Extraction - Hikvision Security Camera

eMMC firmware extraction of BGA flash chip on a hikvision security camera.

IoT Pentesting Certification from TCM:

Need IoT pentesting services?
Please consider Brown Fine Security:

Come join us on Discord for some device hacking!

🛠️ Stuff I Use 🛠️

🪛 Tools:

🫠 Soldering & Hot Air Rework Tools:

🔬 Microscope Setup:

About Me:
My name is Matt Brown and I'm an Hardware Security Researcher and Bug Bounty Hunter. This channel is a place where I share my knowledge and experience finding vulnerabilities in IoT systems.

- Soli Deo Gloria

💻 Social:

#hacking #iot #cybersecurity

[Renzo_]

I would for sure fix up the crc at the bottom of that block of text before going through the work of reballing

[ugh-meh]

I like how you treat the digital calipers as an unnecessary tool, when its literally the only tool I have of the ones used for this project :)

[susugar]

Have to wait the next video to know how uboot handle bad CRC. Maybe it will ignore but sometime not. Keep going buddy. Cheer!

[ginbot]

Nice video! For the XGecu T76 software, when working with eMMC I just use the "AUTO EMMC" option and just auto-detect the eMMC with the "Analysys IC" button. eMMCs are inherently block storage devices (and eMMC standardizes its access that you don't really need the device-specific profiles most of the time), and the UserData.BIN can be treated like a hard disk image. I reckon that the U-Boot environment variable store lives in a partition listed in the MBR or GPT partition table.

11.5x13mm is the most common eMMC size, maybe 10x11 for really compact devices. 12x16 isn't really used anymore, nor is 14x18 except in BGA100 format.

[flywithusMSFS]

Absolute beast of a man. Good Teacher, great content. Good Stuff Matt thanks!

[minerzcollective]

A new video I get excited when there’s a new video

[bene]

This may be a very stupid question, but did you try the `-f` flag with `setenv`? If I understand the U-Boot docs correctly, that may allow you to overwrite read-only variables... Also, `setenv` seems to just be a direct alias for `env set`, not a separate command. Anyway, great video!

[CrazedCrittic]

I have extensive Hikvision but since hearing about the security concerns I have disconnected it to the outside world and instead use Home assistant to view the cameras remotely.

[hedgehogform]

Love your videos!!! Would love to see more advanced stuff such as finding vulns in apps and finding buffer overflows and command injections and using those to gain root.

[tyaprak]

I do not expect a boot sequence check or firmware hash check from the developers which means you will boot right in the sh shell.
I would love to see the next video. ASAP please 😊

[geoffrey]

Great video always, @mattbrwn, may i ask what's the temprature of your hot air gun when you taking the chip off ?

[Spacehelm]

Love your content man! Is that a new printer in the background 👀?

[johncloar]

Thanks Mat very interesting. Bring back memory of my past.

[twizzter]

Wonder if CPU does a FW checksum verification, waiting for the next part!

[marekmatej]

do you use isolated uart converter? usually POE devices cant be connected to the computer ground without causing issues.

[JohnieBraaf]

Great stuff, eagerly waiting for the next one 😄

[codures]

It is that difficult to replace the "linuxrc" file with a tailored one that spawns sh?

[RaduRadi-le]

You have tried to access memory through the JTAG connector ?

[exploreThe_]

Hey Matt, please make a video on voltage injection

[turnkit]

Does sed only change the first instance it finds or did he change ALL the instances of linuxrc?