James Chambers

security research and reverse engineering | security consultant | @[email protected]

[James Chambers @jamchamb_]

New writeup on finding the abandoned NES emulator features in Animal Crossing and using them to get code execution via memory card: https://t.co/NxibYPyxsz

[James Chambers @jamchamb_]

Despite providing proof of concept exploits and multiple rounds of feedback on patches, Espressif refused to acknowledge the memory corruption bugs as security vulnerabilities and won't be issuing any advisories.

[James Chambers @jamchamb_]

Disclosure is finally up for some vulns in the ESP32 BluFi reference app: https://t.co/OmQVWBdX15 most interesting bug to me is the DH public key calculation buffer overflow.

[James Chambers @jamchamb_]

Uploaded the slides for "Reverse Engineering the PowerG Wireless Protocol" @reconmtl https://t.co/PqiXSK8W46

[NCC Group Research & Technology @NCCGroupInfosec]

Checkout the new NanoMIPS plugin/blog post that aided in reverse engineering a Mediatek-based 5G modem image! https://t.co/OwlQmtbFlx #cybersecurity #infosec #tech

[James Chambers @jamchamb_]

If you want to reverse some MediaTek 5G baseband firmware, we're open sourcing our nanoMIPS Ghidra module: https://t.co/HGL0lLzywn

[James Chambers @jamchamb_]

Wrote an overview of using the different Ghidra decompiler simplification styles for P-Code analysis, how to trace the decompilation process, and getting around some issues with analyzing stack write operations. Even used a bug in Ghidra to alter the analysis configuration :)

[NCC Group Research & Technology @NCCGroupInfosec]

Blog: earlyremoval, in the Conservatory, with the Wrench: Exploring Ghidra’s decompiler internals to make automatic P-Code analysis scripts - https://t.co/cGfRQPvA5Z - by James Chambers

[NCC Group Research & Technology @NCCGroupInfosec]

Tool Release: Ghostrings - a collection of Ghidra scripts for recovering string definitions in Go binaries with P-Code analysis - by James Chambers - https://t.co/OFTAxr4JDf - Code - https://t.co/FNicjLx23G

[James Chambers @jamchamb_]

Main demo video for the Snap Station talk

[James Chambers @jamchamb_]

@LiveOverflow @C_S_C_G Cool challenge! Here is the solution I came up with https://t.co/4LRj0K5zf4

[James Chambers @jamchamb_]

@bigbass1997 Yes, I didn't mention it in the post but it works the same way for Pokemon Stadium

[James Chambers @jamchamb_]

I've posted some notes on how the Snap Station protocol works and released the code for the iCEBreaker JoyBus device https://t.co/Zg8LhRE1MA

[James Chambers @jamchamb_]

Implemented this in an emulator as well, here's the overall flow. (In the real kiosk the printer would sync video screen captures with the console for the images displayed after reboot.)

[James Chambers @jamchamb_]

I've been reverse engineering Pokemon Snap (N64) to restore the Blockbuster sticker printing kiosk functionality without the kiosk, finally made some good breakthroughs

[James Chambers @jamchamb_]

I only recently found out the 2010 HOPE badge was also a GoodFET, but I did distinctly remember there was some kind of puzzle hidden in the firmware. In keeping with doing this 11 years late, I dumped the firmware with a GreatFET and found some ciphertext and a raw RGB565 image

[James Chambers @jamchamb_]

Got some basic N64 controller functionality working on an FPGA :) I've been wanting to try this for a while

[James Chambers @jamchamb_]

Dumping K360 wireless keyboard firmware with a GreatFET https://t.co/hPAIvTrSUR

[James Chambers @jamchamb_]

@Sierraffinity I never finished the UI improvements I wanted before release to make it more usable without recompiling 🐢 I'd like to take another look at finishing that when I have some time for projects (this month hopefully), worst case I'll just release it as is

[LiveOverflow 🔴 hextree.io @LiveOverflow]

Awesome🤩
@jamchamb_ wrote a writeup about my Maze game hacking challenge :3

https://t.co/3zeNwqT5rh

[James Chambers @jamchamb_]

@MeganPuddin For .map files what I've done before is make an IDAPython script to extract the function names and addresses and then call idc.MakeFunction, idc.MakeName for each of them. I'm not familiar with the .sym format, the tricky part might be figuring out how to parse the function info

[CTurt @CTurtE]

shogihax - Remote Code Execution on Nintendo 64 through Morita Shogi 64: https://t.co/9glal8tW0O