Willem Melching

I take things apart. Sometimes I put them back together. Consulting & Trainings:

[Willem Melching @PD0WM]

Check out the Saleae FlexRay decoder plugin I wrote this weekend. I was debugging a tricky bug, so it was time to build some proper tooling. Unfortunately, the previous plugin by @robbederks wasn't compatible with Logic 2. https://t.co/W9yJo2OUbF also includes prebuilt files.

[Willem Melching @PD0WM]

@FlUxIuS Didn't realize the VAG TEA keys are public now 😯 They are extractable from BCM update files, so it was probably just a matter of time.

[Willem Melching @PD0WM]

@mietekHiding It’s using PyMuPDF under the hood

[Willem Melching @PD0WM]

I built an MCP server so Claude can properly read PDF datasheets. Not just pdf-to-text, but proper table of contents, search and viewing pages as both text and image. This way it can properly see diagrams and tables. Check it out: https://t.co/PdJqH5nby3

[Willem Melching @PD0WM]

@FlUxIuS Don't forget this research into ID code glitching! https://t.co/oxqTLsEBDn

Also check out Renesas update TN-RH8-B0463A/E, which allows "Prohibition of [...] programmer" and "ID authentication" at the same time. I've seen this in the field, and requires two glitches to bypass.

[Willem Melching @PD0WM]

Just released version 0.3.0 of the automotive crate with Vector support and some bug fixes! Check it out: https://t.co/IqRxL3vBJa

[hakstuff @hakstuff]

This blog post ended up being a bit more industry-focused than I would have liked, but I wanted to do the research because I was curious what the adoption of bug bounty programs looked like in automotive!

https://t.co/x8U0tDDmKa

[Willem Melching @PD0WM]

@Mankaran32 They have it on their website as “standard” assembly: https://t.co/wEjJlhCpTw

But for a production run I would probably just put an RP2354A directly on the PCB.

[Willem Melching @PD0WM]

I created a small PCB that simulates an EV charger connection (IEC 61851) by generating the required ±12V PWM signals. Let me know if this is something you would like to buy from my store!

[Willem Melching @PD0WM]

@Mankaran32 Yes, for sake of prototyping speed this is all hand soldered. If I would sell the boards I would have JLC do PCBA.

[Willem Melching @PD0WM]

@jbx81 The goal of the project is to also support PPC-VLE, RH850 and maybe some other weird architectures. Those are unfortunately not supported by QEMU. It’s also a fun exercise to write the emulator from scratch, and hopefully it will have some more benefits down the road.

[Willem Melching @PD0WM]

I'm 2 weeks into writing a custom emulator for some automotive fuzzing experiments. The designers of the Tricore ISA thought it necessary to define four variants of “reg ≥ imm9 → XOR into LSB of reg.” Who asked for this nonsense?

[Willem Melching @PD0WM]

Inspired by @FraktalCyber's Laser Fault Injection rig, I got an xTool F1. I probably need to use some HNO3 to take off the last bit of packaging. The chips no longer work if I go too far, and the die also looks visually damaged.

[Willem Melching @PD0WM]

Congratulations to @_stephandb_ for being the first to solve all the challenges! He also provided an excellent write-up: https://t.co/lJlevCUcMg.

The CTF will stay up for a few more weeks, so don't worry if you haven't been able to finish all the challenges yet.

[Willem Melching @PD0WM]

I created a small automotive themed CTF! The first person to solve all the challenges will get a free CAN Bus Throwing Star. Check it out at https://t.co/VT4gL6QIL0

[Willem Melching @PD0WM]

@NDagestad My bad! Added the attachment a couple hours ago.

[Willem Melching @PD0WM]

I created a small automotive themed CTF! The first person to solve all the challenges will get a free CAN Bus Throwing Star. Check it out at https://t.co/VT4gL6QIL0

[Willem Melching @PD0WM]

@loosenedspirit Just get one of those yellow "E-NET" cables for that. They are compatible with all DoIP Option 1 pinouts, and contain the resistor. https://t.co/Q3LZGj3hZg

[Willem Melching @PD0WM]

I have opened a hardware shop! Check it out at https://t.co/8rePc1WMAS The first product is the CAN Bus Throwing star, an easy to use converter to connect to all things CAN bus. Let me know what other products you’d like to see next!

[Willem Melching @PD0WM]

@_MG_ You can also try dumping over CAN using UDS $23 (Read memory by address), XCP or CCP. However then you still need to figure out the flashing protocol to get the firmware onto the other EPS.

[Willem Melching @PD0WM]

@_MG_ I have looked at quite a few EPSes, but not Mazda. RH850, PPC and Tricore can all be dumped with inexpensive tools. Besides proprietary JTAG there is usually a UART/CAN bootloader.

However, from what I’ve heard they contain a per unit calibration. That might not be compatible.