Hardware Analysis Process for IoT Hacking - 1

Hardware analysis is essential for effectively carrying out IoT (Internet of Things) attacks. After hardware analysis, the process of extracting and analyzing firmware follows. At this stage, it is necessary to closely examine the code and configurations within the firmware, through which potential vulnerabilities can be discovered. Next, it is also important to understand the PCB (Printed Circuit Board) structure used in embedded systems. Since the PCB structure directly affects the functionality and reliability of the device, problems or weaknesses discovered during its analysis can greatly help in improving the security of IoT devices.

1️⃣ PCB (Printed Circuit Board)

A PCB serves as the foundation for electronic circuits in devices. In embedded systems, it supports both electrical and mechanical components, playing a vital role in the system's overall functionality.

Firstly, it's essential to identify the IC (Integrated Circuit). Then, if there's an available datasheet, gather general descriptions of the product, pin layouts, pin functionality information, and brief function descriptions.

PCBs comprise various elements, each with specific roles. Critical components include the CPU, SPI, and JTAG interfaces.

2️⃣ CPU (Central Processing Unit)

The CPU acts as the "brain" of the PCB, handling calculations, data processing, and command execution. CPUs typically feature numerous pins and are centrally located on the PCB, often accompanied by heat sinks or cooling fans for thermal management.

2.1. UART (Universal Asynchronous Receiver Transmitter)

UART is a controller used for asynchronous communication, utilizing Clock X and Baud Rate. The Baud Rate denotes the data transmission speed over the serial line. Matching the Baud Rate is essential when establishing UART connections to ensure effective communication.

When examining the MCU/SoC's datasheet, you can identify UART through the pin map. UART typically uses four pins:

• TX: Data transmission

• RX: Data reception

• GND: Ground

• VCC: Voltage supply

2.1.1. VCC

VCC represents the positive power supply line in electronic circuits. Originally used in transistor circuits, it now denotes the main power supply in various digital systems. VCC provides the necessary voltage for microcontrollers, sensors, and other electronic components to function properly.

VCC, while not always present, is not used for UART connections when available. The primary goal is to identify pins besides RX and TX. Common indicators include square holes or instances where pin 1 represents VCC.

2.1.2. GND

GND stands for "Ground," indicating the reference voltage point within a circuit. Typically, this reference point signifies electrically neutral grounding, serving as the point where all currents in the circuit ultimately flow. GND provides a baseline for stable operation, prevents voltage mismatches between electronic devices, and offers a safe path in case of excessive current.

2.1.3. TX/RX

TX and RX are abbreviations for "Transmit" and "Receive," respectively, commonly used terms in data communication. TX refers to the line for transmitting data, while RX refers to the line for receiving data. There are several methods to distinguish between TX and RX.

When measuring voltage using a multimeter, the TX pin typically shows active voltage, while the RX pin maintains a high voltage (IDLE state).

Another method to identify TX/RX is by capturing digital signals using a logic analyzer and analyzing the signal.

2.1.4. Baud Rate Measurement (Logic Analyzer)

Baud Rate refers to the number of bits per second (bps) sent. Typically, it can have one of the values: 1200, 2400, 4800, 9600, 19200, 38400, 57600, or 115200.

The Time Delta value between A1 and A2 is 18.33 microseconds. Therefore, the number of signal units per second is 1000000/18.33 = 54555.37, approximately resulting in a Baud Rate of 57600.

UART communication can be established using a USB to UART adapter. The TX line serves for transmitting data, whereas the RX line handles data reception. Consequently, for UART communication to function, one must connect the TX line of a device to the RX line of the adapter, and conversely, link the RX line of a device to the TX line of the adapter.

Confirm the port, usually identified as COM6.

Adjust the port and Baud Rate settings in the serial communication emulator to match, then connect to view boot and debug messages.

2.2. Boot Loader

The boot loader is a system program responsible for initializing the hardware when the system boots up and loading the operating system kernel into memory to execute. It is typically found in the /etc/init.d/rcS file.

Generally, the boot loader resides in static memory such as ROM, Flash, or SRAM, and is positioned at physical address 0 of the system memory.

If immediate shell access is not available, it may be necessary to capture the data output during boot and repackage it into firmware. Setting boot-time variables to /bin/bash allows for the execution of bash during the boot process, facilitating shell access.

With shell access, direct access to the file system enables the insertion or extraction of files. This allows for the installation of new programs, modification of existing ones, and extraction of critical information such as system logs.

Access via UART is commonly used for diagnostics, debugging, and reverse engineering in embedded systems and IoT devices. This method proves highly useful when physical access to the device is available, enhancing security, increasing system understanding, and facilitating efficient firmware-related tasks.

3️⃣ SPI (Serial Peripheral Interface)

SPI (Serial Peripheral Interface) is a serial communication protocol used for communication between a microcontroller and peripheral devices. At its core is a master/slave structure, where the master controls communication and can exchange data with one or more slaves.

3.1. 8-pin SPI Communication

The 8-pin SPI interface has the following pin configuration:

• VCC: Power supply line, supplying power to the peripheral device.

• GND: Ground line, providing a common electrical ground.

• MOSI (Master Out Slave In): Transmits data from the master device to the slave device.

• MISO (Master In Slave Out): Transmits data from the slave device to the master device.

• SCK (Serial Clock): Provides clock signals to control the timing of data transmission.

• SS (Slave Select): Signal used to activate or deactivate the slave device.

• Additionally, it may include IRQ (Interrupt Request) and other control lines.

Through this pin configuration, SPI offers high-speed and reliable data transmission, along with the advantage of simplicity.

3.2. 48-pin SPI Communication

Devices with a 48-pin interface have many more features and are used in advanced devices that require complex communication. The 48-pin configuration can include multiple SS pins and support more data and control lines for more complex communication protocols. These are commonly found in memory chips requiring large data storage or advanced sensors requiring high-speed communication.

3.3. Firmware Extraction

Firmware extraction is typically performed for reverse engineering, security analysis, or firmware updates. Through SPI communication, firmware can be directly read from storage devices such as flash memory. This process involves extracting the entire firmware image by sequentially or randomly accessing data from the memory chip using a dedicated SPI reader or programmer (such as T48 Programmer, T56 Programmer) after SPI chip extraction.