Check out the Saleae FlexRay decoder plugin I wrote this weekend. I was debugging a tricky bug, so it was time to build some proper tooling. Unfortunately, the previous plugin by @robbederks wasn't compatible with Logic 2. https://t.co/W9yJo2OUbF also includes prebuilt files.
I built an MCP server so Claude can properly read PDF datasheets. Not just pdf-to-text, but proper table of contents, search and viewing pages as both text and image. This way it can properly see diagrams and tables. Check it out: https://t.co/PdJqH5nby3
@FlUxIuS Don't forget this research into ID code glitching! https://t.co/oxqTLsEBDn
Also check out Renesas update TN-RH8-B0463A/E, which allows "Prohibition of [...] programmer" and "ID authentication" at the same time. I've seen this in the field, and requires two glitches to bypass.
This blog post ended up being a bit more industry-focused than I would have liked, but I wanted to do the research because I was curious what the adoption of bug bounty programs looked like in automotive!
https://t.co/x8U0tDDmKa
@Mankaran32 They have it on their website as “standard” assembly: https://t.co/wEjJlhCpTw
But for a production run I would probably just put an RP2354A directly on the PCB.
I created a small PCB that simulates an EV charger connection (IEC 61851) by generating the required ±12V PWM signals. Let me know if this is something you would like to buy from my store!
@jbx81 The goal of the project is to also support PPC-VLE, RH850 and maybe some other weird architectures. Those are unfortunately not supported by QEMU. It’s also a fun exercise to write the emulator from scratch, and hopefully it will have some more benefits down the road.
I'm 2 weeks into writing a custom emulator for some automotive fuzzing experiments. The designers of the Tricore ISA thought it necessary to define four variants of “reg ≥ imm9 → XOR into LSB of reg.” Who asked for this nonsense?
Inspired by @FraktalCyber's Laser Fault Injection rig, I got an xTool F1. I probably need to use some HNO3 to take off the last bit of packaging. The chips no longer work if I go too far, and the die also looks visually damaged.
Congratulations to @_stephandb_ for being the first to solve all the challenges! He also provided an excellent write-up: https://t.co/lJlevCUcMg.
The CTF will stay up for a few more weeks, so don't worry if you haven't been able to finish all the challenges yet.
I created a small automotive themed CTF! The first person to solve all the challenges will get a free CAN Bus Throwing Star. Check it out at https://t.co/VT4gL6QIL0
I created a small automotive themed CTF! The first person to solve all the challenges will get a free CAN Bus Throwing Star. Check it out at https://t.co/VT4gL6QIL0
@loosenedspirit Just get one of those yellow "E-NET" cables for that. They are compatible with all DoIP Option 1 pinouts, and contain the resistor. https://t.co/Q3LZGj3hZg
I have opened a hardware shop! Check it out at https://t.co/8rePc1WMAS The first product is the CAN Bus Throwing star, an easy to use converter to connect to all things CAN bus. Let me know what other products you’d like to see next!
@_MG_ You can also try dumping over CAN using UDS $23 (Read memory by address), XCP or CCP. However then you still need to figure out the flashing protocol to get the firmware onto the other EPS.
@_MG_ I have looked at quite a few EPSes, but not Mazda. RH850, PPC and Tricore can all be dumped with inexpensive tools. Besides proprietary JTAG there is usually a UART/CAN bootloader.
However, from what I’ve heard they contain a per unit calibration. That might not be compatible.