4 ms·
Am I understanding right that he essentially printed part of memory to the piezoelectric circuit in binary? How did he get his code to run to do so, or was ther
by j4yav 3y ago
Am I understanding right that he essentially printed part of memory to the piezoelectric circuit in binary? How did he get his code to run to do so, or was there some other technique in play? Really interesting stuff.
- ijustlovemath 3y agoThis is a total guess, but it reads to me like he physically rewired the internals of the device to connect the clicker to the CPU bus, so he could hear instructions as they were processed. Wish there were more details, though, really interesting attack!
- londons_explore 3y agoIf you can physically rewire it, why not simply hook those wires up to another computer and log them...
- ijustlovemath 3y agoYeah I looked it up and the CPU was an SoC, so unlikely that this is the way he did it.
- londons_explore 3y agoI think he must already have code execution, and just used this technique to dump bits of RAM. Perhaps it it was a shellcode exploit, he maybe only had a few hundred bytes of his own code to play with, and maybe no knowledge of memory addresses needed to access 'easier' peripherals like serial UART's.
- _____-___ 3y agoIt sounds like he already had linux running on the device, it just couldn't control/access everything, which was the ultimate goal of this project. So once you have linux running, even without being able to control everything, you have code execution. It seems like there'd be other ways to get the bootloader out, but I'm not familiar with the project, presumably he did the easiest thing he could do - or most interesting.
- chmod775 3y agoJust a guess: He had code execution but couldn't access that memory. However whatever controls that circuit could. So he used that to get to the data.
- nilss 3y agoI did this. You could just dd a binary to the iPods drive (with some magic numbers) and the iPod would execute it on boot. Someone figured this out for older iPods already. The USB storage mode was still available so this was quite safe.