3 ms·

Just reading this post was a lot of work. I can't imagine how these people find the time and patience to work this out from scratch. Its also a show of how inc

Just reading this post was a lot of work. I can't imagine how these people find the time and patience to work this out from scratch. Its also a show of how incredibly complex phones are where just the nfc chip has its own bootloader and firmware and update protocol.

non-entity 6y ago
I've always wondered this as well. Often times I wouldn't even know where to start investigating things like this.
- nirav72 6y ago
  The biggest issue I run into when investigating something like this is the community centric lingo. Go over to any one of the forums around a specific topic - you'll spend days just attempting to figure the language. I'm still attempting to decipher all the android rooting/flashing terms the community uses over on the XDA forum.
mindslight 6y ago
Some patience is required, yes. But mostly you're driven by the challenge itself. There is a beauty in working with raw bytes. No worrying about maintainability or code reuse, no layers of abstraction - just finding the right combination that solves the problem. Abstraction comes later as you understand the space and see the patterns. And yeah, seemingly every modern chip has ended up with its own ARM processor with some undocumented firmware blob, to provide its "hardware" functions. Better than bespoke state machines, I guess. One of the ways the S3 (and I think S4) can self-brick is that the flash controller table gets corrupt, so its firmware goes into a boot loop (making the flash chip disappear to the main processor). Someone did a similar reverse engineering trek to unbrick S3s that have fallen victim to this bug. I just wish the chip registers were documented in the datasheet, and the firmware more open. I've got a bricked S4 with some concert pics that I'll get around to hacking on some day... > As I had replicated this vulnerability, I disclosed it to Samsung, as it was likely they would want to remediate it. Remediation was performed by them on all newly manufactured chips, as well as chips currently in development, as of April 2020 facepalm. The NFC chip firmware integrity is assured by it being loaded from the application processor. Signature schemes that prevent users from running their own code on devices they own are unjust, and you're doing nobody any favors by reporting bugs in them (apart from the power-hungry manufacturers pushing this junk). The author has basically obsoleted their own code on future models.
- R0b0t1 6y ago
  The concept of professional release has been used against consumers so often I wonder why people still do it.

non-entity 6y ago

I've always wondered this as well. Often times I wouldn't even know where to start investigating things like this.

nirav72 6y ago
The biggest issue I run into when investigating something like this is the community centric lingo. Go over to any one of the forums around a specific topic - you'll spend days just attempting to figure the language. I'm still attempting to decipher all the android rooting/flashing terms the community uses over on the XDA forum.

mindslight 6y ago

Some patience is required, yes. But mostly you're driven by the challenge itself. There is a beauty in working with raw bytes. No worrying about maintainability or code reuse, no layers of abstraction - just finding the right combination that solves the problem. Abstraction comes later as you understand the space and see the patterns. And yeah, seemingly every modern chip has ended up with its own ARM processor with some undocumented firmware blob, to provide its "hardware" functions. Better than bespoke state machines, I guess. One of the ways the S3 (and I think S4) can self-brick is that the flash controller table gets corrupt, so its firmware goes into a boot loop (making the flash chip disappear to the main processor). Someone did a similar reverse engineering trek to unbrick S3s that have fallen victim to this bug. I just wish the chip registers were documented in the datasheet, and the firmware more open. I've got a bricked S4 with some concert pics that I'll get around to hacking on some day... > As I had replicated this vulnerability, I disclosed it to Samsung, as it was likely they would want to remediate it. Remediation was performed by them on all newly manufactured chips, as well as chips currently in development, as of April 2020 facepalm. The NFC chip firmware integrity is assured by it being loaded from the application processor. Signature schemes that prevent users from running their own code on devices they own are unjust, and you're doing nobody any favors by reporting bugs in them (apart from the power-hungry manufacturers pushing this junk). The author has basically obsoleted their own code on future models.

R0b0t1 6y ago
The concept of professional release has been used against consumers so often I wonder why people still do it.