3 ms·
TLDR: Soldered onto some pins, identified power usage pattern during boot sequence characteristic of Flash read, wrote a search program to glitch the chip at ju
by rkagerer 6y ago
TLDR: Soldered onto some pins, identified power usage pattern during boot sequence characteristic of Flash read, wrote a search program to glitch the chip at just the right moment when it loads the protection flag.
Apparently able to make exploit persistent, and demo coming up in future post on a real consumer product (Logitech Mouse). Couldn't reach agreement with Nordic on a responsible disclosure mechanism.
- floatboth 6y ago> Apparently able to make exploit persistent Well, that's just how the nRF's protection works: you can always disable it, erasing the flash. They glitched the chip to access debug without disabling protection → can dump the firmware now → obviously possible to disable it and then reflash the recovered firmware.
- kosma 6y agoThis works on a surprisingly large number of chips.