Analysis of a door locking system Introduction Signals Hardware - PowerPoint PPT Presentation

Analysis of a door locking system Rémi Audebert, Pierre Surply Analysis of a door locking system Introduction Signals Hardware Software Rémi Audebert Pierre Surply In situ Conclusion 2014-07-17 Rémi Audebert, Pierre Surply Analysis of a door locking system 2014-07-17 1 / 51

Analysis of a door locking system Rémi Audebert, Pierre Surply Introduction Signals Hardware Software Introduction In situ Conclusion Rémi Audebert, Pierre Surply Analysis of a door locking system 2014-07-17 2 / 51

The situation Analysis of a door locking system Rémi Audebert, Pierre Surply Introduction Signals Hardware Software In situ Conclusion The door lock is broken: fix-it! Power is working, the door is always locked Control is not working Rémi Audebert, Pierre Surply Analysis of a door locking system 2014-07-17 3 / 51

This talk is about. . . Analysis of a door locking system Rémi Audebert, Part 1: Electrical reverse engineering Pierre Surply Power, signals, 9N1, . . . Introduction Signals Part 2: Hardware reverse engineering Hardware Microcontrollers, converters, PHY, . . . Software Part 3: Software reverse engineering In situ Conclusion PIC16F87, architecture, banking, . . . Part 4: A practical use of this knowledge The big picture, controlling a door ourself Rémi Audebert, Pierre Surply Analysis of a door locking system 2014-07-17 4 / 51

Analysis of a door locking system Rémi Audebert, Pierre Surply Introduction Signals Hardware Software Signals In situ Conclusion Rémi Audebert, Pierre Surply Analysis of a door locking system 2014-07-17 5 / 51

Probing Analysis of a door locking system Rémi Audebert, Pierre Surply Introduction Signals Hardware Software In situ Conclusion Figure 1: Probe points Rémi Audebert, Pierre Surply Analysis of a door locking system 2014-07-17 6 / 51

Probing Analysis of a door locking system Our goal: identify signals Rémi Possible signals: Audebert, Pierre Surply Power Introduction Ground(s) Signals Clock Hardware Data Software Differential data In situ Pull up Conclusion Tools Multimeters Digital Oscilloscope (ATTEN ADS1102CAL 100MHz) Logic analyser (Saleae Logic) Rémi Audebert, Pierre Surply Analysis of a door locking system 2014-07-17 7 / 51

Probing Analysis of a door locking system Rémi Audebert, Pierre Surply Introduction Signals Hardware Software In situ Conclusion Figure 2: Probe points Rémi Audebert, Pierre Surply Analysis of a door locking system 2014-07-17 8 / 51

Pinout Analysis of a door locking system Rémi Audebert, Pierre Surply 5V Introduction Signals Ground Hardware ? Software ? In situ ? Conclusion ? Rémi Audebert, Pierre Surply Analysis of a door locking system 2014-07-17 9 / 51

Frame analysis Analysis of a door locking system Rémi Audebert, Pierre Surply Introduction Signals Hardware Software In situ Conclusion Figure 3: Frame Rémi Audebert, Pierre Surply Analysis of a door locking system 2014-07-17 10 / 51

Frame analysis Analysis of a door locking system Rémi Audebert, Pierre Surply Introduction Signals Hardware Software In situ Conclusion Figure 4: Frame Rémi Audebert, Pierre Surply Analysis of a door locking system 2014-07-17 11 / 51

Standard data signals Analysis of a door locking system Rémi Audebert, Pierre Surply Introduction UART TTL Signals I2C Hardware RS232 Software SPI In situ . . . Conclusion Rémi Audebert, Pierre Surply Analysis of a door locking system 2014-07-17 12 / 51

SPI Analysis of a door locking system Rémi Audebert, Pierre Surply Introduction Signals Hardware Software In situ Conclusion Figure 5: Frame Rémi Audebert, Pierre Surply Analysis of a door locking system 2014-07-17 13 / 51

Chip Select Analysis of a door locking system Rémi Audebert, Pierre Surply Introduction Signals Hardware Software In situ Conclusion Figure 6: Frame Rémi Audebert, Pierre Surply Analysis of a door locking system 2014-07-17 14 / 51

MOSI Analysis of a door locking system Rémi Audebert, Pierre Surply Introduction Signals Hardware Software In situ Conclusion Figure 7: Frame Rémi Audebert, Pierre Surply Analysis of a door locking system 2014-07-17 15 / 51

Pinout (SPI) Analysis of a door locking system Rémi Audebert, Pierre Surply 5V Introduction Signals Ground Hardware MOSI Software MISO In situ SS Conclusion SCK Rémi Audebert, Pierre Surply Analysis of a door locking system 2014-07-17 16 / 51

MISO Analysis of a door locking system Rémi Audebert, Pierre Surply Introduction Signals Hardware Software In situ Conclusion Figure 8: Frame Rémi Audebert, Pierre Surply Analysis of a door locking system 2014-07-17 17 / 51

Probing Analysis of a door locking system Rémi Audebert, Pierre Surply Introduction Signals Hardware Software In situ Conclusion Figure 9: Probe points Rémi Audebert, Pierre Surply Analysis of a door locking system 2014-07-17 18 / 51

The hanging connector Analysis of a door locking system Rémi Audebert, Pierre Surply Introduction Signals Hardware Software In situ Conclusion Figure 10: Ceiling cable Rémi Audebert, Pierre Surply Analysis of a door locking system 2014-07-17 19 / 51

Probing Analysis of a door locking system Rémi Audebert, Pierre Surply Our goal: identify signals Introduction Possible signals: Signals Hardware Power: 12V Software Ground: Yes In situ Clock Conclusion Data Differential data: On two wires Rémi Audebert, Pierre Surply Analysis of a door locking system 2014-07-17 20 / 51

Standard data signals Analysis of a door locking system UART TTL Rémi SPI Audebert, Pierre Surply I2C Introduction RS232 Signals Ethernet PHY Hardware CAN Software RS485 In situ Conclusion Rémi Audebert, Pierre Surply Analysis of a door locking system 2014-07-17 21 / 51

Standard data signals Analysis of a door locking system UART TTL Rémi SPI Audebert, Pierre Surply I2C Introduction RS232 Signals Ethernet PHY Hardware CAN Software RS485 In situ Conclusion RS485 in short Two wires: A and B Differential signal: A - B <-200mV is 1 A - B >+200mV is 0 Rémi Audebert, Pierre Surply Analysis of a door locking system 2014-07-17 21 / 51

Multidrop RS485 Analysis of a door locking system Rémi Audebert, Pierre Surply Introduction Signals Hardware Software In situ Conclusion Same bus One master, many slaves Bidirectional communication: Master polls slaves periodically Slave answer when talked to Rémi Audebert, Pierre Surply Analysis of a door locking system 2014-07-17 22 / 51

Frame Analysis of a No clock! door locking system Rémi Audebert, Pierre Surply Introduction Signals Hardware Software In situ Conclusion Figure 11: A word in this protocol Principles of 9bit data mode 9th bit is used to signal an address The slave only listen when the address matches it’s own Rémi Audebert, Pierre Surply Analysis of a door locking system 2014-07-17 23 / 51

Messages Analysis of a door locking system Rémi Audebert, Pierre Surply Introduction Signals Hardware Software In situ Figure 12: Message structure Conclusion Rémi Audebert, Pierre Surply Analysis of a door locking system 2014-07-17 24 / 51

Modbus Analysis of a door locking system Modbus RTU Rémi Audebert, Another serial communication protocol Pierre Surply Introduction Similarities Signals Same CRC polynom Hardware Software Message format In situ Conclusion Differences with modbus RTU Not the same function Use an address bit Broadcast address is FF Rémi Audebert, Pierre Surply Analysis of a door locking system 2014-07-17 25 / 51

Probing: done! Analysis of a door locking system Rémi Audebert, Pierre Surply Introduction Signals Hardware Software In situ Conclusion Figure 13: Probe points Rémi Audebert, Pierre Surply Analysis of a door locking system 2014-07-17 26 / 51

Analysis of a door locking system Rémi Audebert, Pierre Surply Introduction Signals Hardware Software Hardware In situ Conclusion Rémi Audebert, Pierre Surply Analysis of a door locking system 2014-07-17 27 / 51

We have boards Analysis of a door locking system Rémi Audebert, Pierre Surply Introduction Signals Hardware Software In situ Conclusion Identify the parts Dump what you can Rémi Audebert, Pierre Surply Analysis of a door locking system 2014-07-17 28 / 51

Recognizing the parts Analysis of a door locking system Rémi Audebert, Pierre Surply “Passive” components: Introduction Resistors Signals Capacitors Hardware Inductors Software In situ “Active” components: Conclusion Microcontrollers PHY, signal converters Rémi Audebert, Pierre Surply Analysis of a door locking system 2014-07-17 29 / 51

Components Analysis of a door locking Screen Board system Rémi UART to RS232 Audebert, Pierre Surply PIC16F877 Introduction Secu Board Signals Hardware UART to RS485 Software Relay In situ PIC18F6720 Conclusion Unknown Board UART to RS485 Ethernet PHY PIC18F2480 Rémi Audebert, Pierre Surply Analysis of a door locking system 2014-07-17 30 / 51