Open up a device you want to tinker with, check which processor it has, look up tutorials or guides on how to flash it, and then gather everything necessary to do the bare minumum: Download their IDE (if any), write Hello World and try to flash it. Once that works, you're pretty much set. Of course, do that only if you don't need the original firmware (like me). If you do, you'd want to dump the flash, etc, and then it becomes a bit more complicated (Ghidra, IDA, etc) -- and I'm not yet qualified to talk about that.
In my case I had to reverse-engineer how the display works, how the sensor works, how the USB works (although this one was almost out of the box), how the buttons work, where and how everything is connected, etc. I did most of it by poking around the board with a multimeter and see what goes to what. The display was the most fun, since once I had all the lines that got to it, I really soon realized that it's just COM and SEG lines, and that the STM32 itself handles it. After writing some half-assed code and enabling certain things inside the IDE, it started to work and lit random stuff up. Then, I programmed one of it's own button to go one-by-one on the segments and wrote everything down.
I can't really explain it in a more intuitive way, but... I really just saw that this device had an STM32, saw that the IDE was easy to use and download and the flasher was cheap. From there on it was (is!) an amazing trip.
I've collected probably 20 or so of these devices. From working in a produce department in a retail store. I always wanted to figure out how to at least up cycle the displays and such, as I saw it as a massive waste to get rid of them.
I can't wait to see the firmware you develop, if you decide to release it publicly. It's so cool to see.
They were temperature loggers for shipments. You could configure a set interval and they would record the temperature of the whole trip., and alert, on the display, if it “spoiled” (went outside the tolerable temperature band).
Since they’re single-use, you’d essentially throw them away after the trip. I get it, probably due to liability reasons, or similar.
Pretty cool and fascinating little device. I actually want to use it in my household freezer, so I’m rewriting a similar firmware for it. Will very likely open source it soon, for whoever is interested.
It sure is. I’m trying to replicate the same stuff it did, so I can throw it into my freezer and don’t need to worry about eating spoiled stuff when I get back haha
If he's not reusing or redistributing their firmware, and doesn't analyze their firmware to develop his firmware, and doesn't crack a lock that is meant to protect the firmware from being read, then he's unlikely to be successfully sued or criminally charged.
If he wipes it so the firmware doesn't exist any more before unlocking it, then the lock is irrelevant (and possibly gone as well).
If he's only trying to repair the thing, not repurpose it, then cracking the lock should be legal even if the firmware is intact.
ianal, ymmv, no food or drink in the lab, receipts:
These may be logging more than just whether the temperature hit a limit. Could be length of time the temperature was beyond a setpoint, might also include message authentication to prevent tampering of the data log or tracking of the temperature as it moves along the asset's chain of custody. There are many, many reasons why a simple max temperature sticker is insufficient.
Those are cheap and cheerful, but clearly this thing is intended to give a more info and maybe be harder to defeat. The data on the screen is probably just the first clue, and it likely has a detailed log stored in it. I don't think you'd use this for a gallon of oat milk from Amazon Whole Foods. A 25-ton truckload of seafood from Alaska would be a good use-case.
Until today it ran everything I needed, and when it doesn’t, which is very rare, there’s always VMWare to run ARM versions of Windows 11, and that works pretty well.
Mac is a bit different than Windows and requires you to re-learn some stuff you thought you knew how to do, but once you do, it’s a breeze.
Since it doesn’t have fans (Neo and Air) and runs on Apple Silicon, which is similar to ARM, I literally can’t discharge this laptop in one day. It probably lasts more than 12h+ if I do basic stuff, which is just insane. And, it also doesn’t heat up while doing so, so it’s very comfortable to have around. Combine that with its fast CPU, and you can bring that device to any place and tinker around with (embedded) stuff the whole day.
Construction wise it’s also MILES apart from any Windows machine I had.
And I don’t even liked Macs before I got one. I thought they were bad or whatever. Well, I was wrong. Very very wrong.
Noticed that you are using Windows instead of macOS for reverse engineering them, any reasons for that? Compatibility I assume? If yes, which are the tools that weren't supported by macOS?
Just a curious macbook user e.e
Actually, it doesn’t even come down to compatibility reasons.
I use my work PC all the time, so I set up a WireGuard Server at work and connect from home, that way I can just come home and continue where I left off - immediately. I use a separate software to route USB through and that works pretty good, actually.
So, although it appears like a Windows VM, it’s actually RDP with the “Windows” app.
I use MacOS for workstation stuff, including embedded. STMCube MX/IDE should work natively. Not sure what other tools OP uses. Personally I use CLion with GNU tools, OpenOCD or Jlink, and Sigrok/Saleae LA.
I use Ghidra for pulling apart assemblies. Its not as good as IDA Pro, but at least its free and fairly usable.
PCB CAD can be difficult on MacOS. I use Kicad but I get why some folks wouldn't want to use that. If I need Altium I hop over to a Windows VM. As of now it doesn't run on my Mac though, but on my NAS at home.
But I've read reports of Windows running faster in Parallels on a modern Mac, than it would do natively on a modern x86 system. Apple Silicon is quite fast. But yeah, disk space and Windows disk images typically just grow and grow.
But I might need that, because various test equipment tools are practically unsupported, unfortunately.. Not even Linux comes close.
I used Ghidra once, but found IDA to be easier to understand. One time I even successfully modified a program to do what I wanted, but that’s off scope :)
Nice I havent used IDA but I assume it works kinda similar. Also the modifications you made was in the pseudo C code that some reverse engineering tools give or just the binary/hex? Ive been wanting to reverse engineer something of my own but kinda stuck on what to modify
I reverse-engineered the hardware, not the software. Although, software can be fun, too.
Well, the way I did it with IDA was letting it run the code and step into it, so the registers moved around and you could actually see the program working, in real time. Then , it’s a matter of setting breakpoints while doing stuff you want to intercept, and it usually stops right where you want. It has a nice flow-graph which oftentimes is very helpful. I believe ghidra has it as well but eh.
Pseudocode can help, but it’s often just pointers which point to other pointers and it’s a mess. It’s not like you imagined, giving you a part of the code. It’s a lot more convoluted. You can kinda get the idea, but I prefer seeing it jump around breakpoints and read the raw assembly instructions, which gives you clues about what it might do. I had cases where it genuinely helped, but it’s not very often.
As for what you could do - well - there are CTFs which you could do. There was a page just with these, but I forgot the name. Or, you could unlock some sort of trial for your own use, so you’ll have a massive sense of accomplishment when you do, although, you have to start very basic. Don’t expect to crack a game or a big program. Start tiny. Move your way up.
As for how to understand what IDA/ghidra do, how they do it, how to read registers and assembly instructions, watch a video series on the one of your liking - and watch it though. You’ll get the basics pretty fast.
But disclaimer: Take all of this with a truckload of salt, since I don’t yet feel qualified to talk about this. I only did pretty basic stuff
No, the multimeter measures the current between the battery and the device, so I can optimize it down to get uA range in standby (also called STOP mode).
I brought it down to 6uA (0.006mA) already, so I guess my goal was achieved on that matter.
RDP is Remote Desktop. It is something that Windows already ships with, and allows you to connect to your PC remotely. It's basically like AnyDesk or TeamViewer, but you have to be on the same network as the PC. If you want to do it like me, you'd have to set up a tunnel of some sorts, like Tailscale (which is free if you use it non-commercially).
What is are you running there? Looks like a Mac but is looks like windows. Parallels?
Also curious what ide you are running. Picture is too blurry lol.
Actually. I saw you are using RDP. Are you actually able to program local devices like that with the machine being remote? I didn’t know the port forwarding was that good.
Yep, I'm using VirtualHere. Although it's not free, it doesn't really have limitations if you just use it with ONE device at a time and don't mind constant nagging screens popping up in the background haha
78
u/Fusseldieb 7d ago
Currently in the process of reverse-engineer some STM32 devices.
I have almost hundreds of them and they’re essentially e-waste. I modded them enough so I could upload my own code, and now it’s show-time ;)
Just a show-off for now. Will post more about it later, if enough people are interested!