NexMon

NexMon is a firmware patching framework for the BCM4339 WiFi firmware of Nexus 5 smartphones.

[yesimxev @yesimxev]

Meet the MASTERS of wireless reverse engineering! @kalilinux NetHunter Episode 2 is out now! It was a pleasure to have the @nexmon_dev team on 📱⌚📡 @offsectraining https://t.co/UEbf4DHZJh

[@[email protected] @seemoolab]

We just won the @acm_wisec best paper award for our paper about @AirGuardAndroid 🥳

[NexMon @nexmon_dev]

@jiska___ @LiveOverflow https://t.co/HYGhMDWBQZ for reverse engineering and patching of broadcom/cypress wifi firmwares.

[AirGuard @AirGuardAndroid]

We published a pre-print paper about AirGuard. How does the app work? How does it perform against the iOS tracking detection and what can we learn from the anonymous data shared by the user?

https://t.co/jiFRyhCW6x

[Jiska @naehrdine]

The remaining @acm_wisec tutorials are online: open-sourcing research projects by Milan (@seemoolab), firmware reverse engineering with Ghidra by @ghidraninja, firmware rehosting with avatar2 by @nSinusR and details on a 5G testbed by @gvinevere (@5g_lab & @ComNets_TUD).

[@[email protected] @seemoolab]

The paper is online – reverse engineered details on WiFi password sharing and Handoff on Apple devices.
https://t.co/4s7rYMTR9Y

[NexMon @nexmon_dev]

Very nice that you finally found the shared memory regions between Wi-Fi and Bluetooth chip. As nexmon just patches the Wi-Fi firmware before loading it, we could try to load a patched Wi-Fi firmware using the Bluetooth chip and then reset the Wi-Fi chip to start it.

[Jiska @naehrdine]

Code execution on a Broadcom Bluetooth chip leads to code execution within Wi-Fi. This has a couple of interesting implications for utilizing Wi-Fi without @nexmon_dev 📱, Wi-Fi debugging 🐛, and exploitation 💥

More details on CVE-2020-10367 (unpatched): https://t.co/TWMwdbQHkM

[NexMon @nexmon_dev]

@jiska___ Oh maybe Samsung has different chips in the european and the international variants.

[NexMon @nexmon_dev]

@jiska___ Very nice :-) Would you mind also disabling SELinux O:-)

[NexMon @nexmon_dev]

Happy Easter! Today I published our monitor mode and frame injection patches for the BCM4375 Wi-Fi chips installed in Samsung Galaxy S10 and S20 smartphones.
I am still looking for access to a Galaxy S21 to analyze its firmware. https://t.co/t9hEbfC7xF #nexmon

[@[email protected] @seemoolab]

We reverse-engineered @Apple's Find My network for tracking offline #Bluetooth devices. Corresponding paper at @PET_Symposium. Create your own #AirTags today: https://t.co/f32oToDSti

[NexMon @nexmon_dev]

@enovella_ S10 patch is ready just need to find some time to publish it.

[NexMon @nexmon_dev]

Who has a Galaxy S21 and could give me access to the BCM4389 WiFi 6e firmware files? And maybe remotely to the device to dump the chip's ROM?

[NexMon @nexmon_dev]

Take a look at https://t.co/RjWV0IC9DU to decode the first episode of biohackers encoded in DNA on https://t.co/pDHnafWtEy

[NexMon @nexmon_dev]

@jiska___ Jiska in der Wirtschaft? Schwer vorstellbar ...

[Jiska @naehrdine]

It's online! Bluetooth RCE == Wi-Fi RCE. Say hello to Spectra, the concept of breaking wireless chip separation as they share the same spectrum. #BlackHat
https://t.co/C03tUsfJ1o

[NexMon @nexmon_dev]

@naehrdine found a new PRNG related vulnerability in the Galaxy S8's Bluetooth chip.
https://t.co/4fp8n61ZEz https://t.co/IeEwoCM1WX
https://t.co/JksSgWiZ3L

[NexMon @nexmon_dev]

@naehrdine Nice work does it also work for ARM or also for the D11 ucode (b43 assembly)?

[Jiska @naehrdine]

Since people were asking how it works internally, here is Jan's final presentation, which covers the most important aspects why ARM Thumb2 disassembly was problematic and how the binary-only approach works. (9/8)
https://t.co/nxn1Uvzvbg

[NexMon @nexmon_dev]

@naehrdine pong