#04 - How To Get The Firmware - Hardware Hacking Tutorial

If you are struggling to get the firmware out of your device, this is the video for you!

In this video I will explain the possible ways we can use to to get the firmware of our IoT device.

I will do a practical example, of one of these possible ways. I will connect the PC to the UART of our sample device, I will analyze the boot log, I will access the command line interface of the boot loader, and I will dump the firmware, exploiting the dump command available in the boot loader. I will use a couple of scripts, do dump the entire EEPROM in an hexadecimal ASCII text file, and, then, to convert back this file in binary form to get the exact image of the EEPROM.

********* Links with additional Information

[mihaifelseghi]

You sir are a human university, the best tutorials ever made, the most comprehensive and clear, keep up the good work, I am waiting for the next video in the series.

[oscareriksson]

I am a programmer at a finance company, but was always interested in hardware, mostly from a software perspective. I started looking at this series about a year ago and it kick-started a burning interest in electronics and hardware hacking in general. Now my desk is overcrowded with bread boards, several chips and boards like raspberry pies, several arduinos of different types, standalone mc chips, avr and arm cortex and have started soldering stuff together with sensors etc etc. The wires are every where. Even spreding out to the living room! Now I have started looking into openocd and things to get to the bottom of the hardware communication things, saw this video series again and this time I understand wth you are explaining (in terms of technology) which makes me appreciate the video series even more. Grazie mille!

[MattSimmonsSysAdmin]

I am totally loving this channel. Thank you for spending the time and effort sharing your knowledge. I have so many of your videos to watch!

[bysectrademark]

This is perfect channel for all beginers in reverse firmware education and understanding what firmware works...Great job! Maybe in future we can send you some firmwares and you can make video from firmware analys this firmware.

[taterfpv]

This showed up in my feed today. I have no need to do any of this but I watched the entire video. You explain everything so well I just kept watching. Good job man.

[louieearle]

This was a fantastic video - you have clear depth of knowledge, and you present better than almost every other hardware reversing video.

I particularly like the context you give. So often presenters just show a wall of cryptic commands and output. You do a fantastic job in explaining.

[celebris]

Valerio, I really like the way you explain - detailed, clear and comprehensive, no shortcuts, no hiding details. Thank you for sharing your experience to us. I just discovered your channel, already subscribed and can't wait to watch from the beginning. Keep up the good work, I am sure this channel will grow up quick. (Y)

[GastoNet]

Ciao Valerio! You have the most instresting channel I've subscribed in my whole life! Keep the good work and stay safe.

[murrij]

like i said in my tweet earlier today, this whole series is awesome. you fill in the blanks on a lot of information that is all over on YouTube but not i none place. thank you.

[TheMadMagician]

Fantastic video's, the density of information is incredible to me!
Absolutely loving this series, and particularly this video so far, there are so many things I always wondered about in boot logs that you have addressed, it's inspiring me to learn more about all the other bits in there as well!

[WereCatf]

Just in case someone stumbles upon here: uboot often has the commands to dump the contents of any connected SPI NOR or NAND flash disabled. Also, e.g. Xiaomi likes to disable UART-input entirely for uboot and the installed OS, so none of this will work in that case and you will need to either access the flash directly, use JTAG or find a vulnerability for the installed OS that lets you get root access that way.

[garypaulson]

Am really enjoying this video series, thank you! I also am an old man who learned Perl :)

[ronwellman]

I was all smiles during this entire video. Your expertise shows through and this was the exact content I was looking for. I am excited to learn more. Thank you!

[markp]

Re: TSOP (at 7:31) - there are clips for chips like this available. They can be found by searching for something like "nand tsop clip" or "360 clip". Security researchers use them to find TOCTOU (etc) firmware security flaws.

[anuradhapriyankara]

I have watched most of your videos and what can I say is your videos are fantastic and very informative. I am too an electronic engineer and I'm trying to reverse engineer a set top box these days. Your tutorials were very much helpful for me. I'm currently trying to extract the firmware using JTAG since I have successfully identified JTAG port using your tutorial. Keep up the good work!
P.s- you have a nice accent too ;-) I like it

[BobanZikic]

This is the best explained how to i have ever seen. Must go back to begging and to watch everything...

[lindsay]

Valerio, a genuinely informative video, packed with useful, advanced information that will inspire and spark the interest of tinkerers, young and old, everywhere. We all thank you for sharing so generously. For the feedback you asked for, I would encourage more use of text to display names and acronyms, because you naturally have an endearing strong accent and this could improve the clarity for a wider audience. I will definitely be learning from more of your videos. Subscribed.

[edgeeffect]

I am also an old man.... I haven't seen Expect or TCL for many years.... Expect was ("was", "IS") wonderful for this sort of thing.
In the past I ran "end of day" on our mainframe using something very much like expect and my manager thought it was "black magic".
I want to go back and look at my old TCL scripts now.

[papamidnightfpv]

I have always wanted to get into hardware hacking. This video is great I hope you keep them coming.

[gtpsic]

Fantastic video production. So fascinating. You did a great job. This was easy to follow and packed with so much info.

Just fascinating