I take things apart. Sometimes I put them back together. Consulting & Trainings: https://xitter.cf/t.co/HDoTb6QsAF
The Netherlands
Joined June 2009
- Tweets143
- Following665
- Followers2.9K
- Likes467
Willem Melching retweeted
What does a car hacker's toolbox actually look like?
Find out in this hands-on training with Willem Melching, where you'll work with real ECUs, reverse engineer firmware, and explore attacks on modern vehicle communication networks.
Register now: lnkd.in/eTUrAuwJ
Check out the Saleae FlexRay decoder plugin I wrote this weekend. I was debugging a tricky bug, so it was time to build some proper tooling. Unfortunately, the previous plugin by @robbederks wasn't compatible with Logic 2. github.com/I-CAN-hack/flexra… also includes prebuilt files.
I built an MCP server so Claude can properly read PDF datasheets. Not just pdf-to-text, but proper table of contents, search and viewing pages as both text and image. This way it can properly see diagrams and tables. Check it out: github.com/I-CAN-hack/pdf-mc…
Just released version 0.3.0 of the automotive crate with Vector support and some bug fixes! Check it out: docs.rs/automotive/0.3.0/aut…
Willem Melching retweeted
This blog post ended up being a bit more industry-focused than I would have liked, but I wanted to do the research because I was curious what the adoption of bug bounty programs looked like in automotive!
hakstuff.net/blog/car-hackin…
I created a small PCB that simulates an EV charger connection (IEC 61851) by generating the required ±12V PWM signals. Let me know if this is something you would like to buy from my store!
I'm 2 weeks into writing a custom emulator for some automotive fuzzing experiments. The designers of the Tricore ISA thought it necessary to define four variants of “reg ≥ imm9 → XOR into LSB of reg.” Who asked for this nonsense?
![Calculate the logical XOR of D[c][0] and the Boolean result of the GE or GE.U operation on the contents of data register D[a] and either data register D[b] (instruction format RR) or const9 (instruction format RC). Put the result in D[c][0]. All other bits in D[c] are unchanged. D[a] and D[b] are treated as 32-bit signed (XOR.GE) or unsigned (XOR.GE.U) integers. The value const9 is sign-extended (XOR.GE) or zero-extended (XOR.GE.U).](https://pbs.twimg.com/media/G0Sj1lXXQAALB0_.png?name=orig)
ALT Calculate the logical XOR of D[c][0] and the Boolean result of the GE or GE.U operation on the contents of data register D[a] and either data register D[b] (instruction format RR) or const9 (instruction format RC). Put the result in D[c][0]. All other bits in D[c] are unchanged. D[a] and D[b] are treated as 32-bit signed (XOR.GE) or unsigned (XOR.GE.U) integers. The value const9 is sign-extended (XOR.GE) or zero-extended (XOR.GE.U).
Inspired by @FraktalCyber's Laser Fault Injection rig, I got an xTool F1. I probably need to use some HNO3 to take off the last bit of packaging. The chips no longer work if I go too far, and the die also looks visually damaged.
Congratulations to @_stephandb_ for being the first to solve all the challenges! He also provided an excellent write-up: icanhack.nl/ctf_writeup.pdf.
The CTF will stay up for a few more weeks, so don't worry if you haven't been able to finish all the challenges yet.
I created a small automotive themed CTF! The first person to solve all the challenges will get a free CAN Bus Throwing Star. Check it out at ctf-teaser.icanhack.nl
I created a small automotive themed CTF! The first person to solve all the challenges will get a free CAN Bus Throwing Star. Check it out at ctf-teaser.icanhack.nl
I have opened a hardware shop! Check it out at shop.icanhack.nl/ The first product is the CAN Bus Throwing star, an easy to use converter to connect to all things CAN bus. Let me know what other products you’d like to see next!
Did anyone find a worthy replacement of the Transcend RDF5K to read EMMC In-Circuit in 1 bit mode without spending $$$? Bought a bunch of cheap SD card readers from Amazon to test with, but none show up as mmcblk.
So you want to build some shellcode for an ECU? I made a collection of Dockerfiles to set up gcc for V850, PowerPC-VLE and TriCore.
It compiles binutils and gcc based on the GPL sources/patches from the proprietary compilers such as S32DS and HighTec C.
github.com/I-CAN-hack/automo…
We did it again!!! We got 1st place in the #defcon32 @CarHackVillage CTF. This year we won a Tesla Model 3, and the whole team has their own Black Badge now 😎. @gregjhogan @robbederks
Willem Melching retweeted
An interesting talk at #hw_ioUSA2024 🚗 👨💻 that allows uploading a payload to RAM and getting the ECU to execute it. Using this exploit, @PD0WM and @gregjhogan could extract the SecOC keys.
YouTube Link: youtu.be/8958gH3KD3Y?si=DSD5…
#carhacking #secoc #reverseengieering
Willem Melching retweeted
Check out my new blog, coauthored with @js0n37 Learn how we unlocked Renesas RH850 security by breaking 16-byte ID code authentication using Voltage Glitching to extract firmware on Automotive ECUs.
Read the full article here: lnkd.in/d3zqKE6a
#AutomotiveSecurity
Willem Melching retweeted
Fast and Curious: Emulating Renesas RH850 System-on-Chip using Unicorn Engine
Brought to you by @virtualabs and @Phil_BARR3TT to make your automotive vulnerability research easier
blog.quarkslab.com/emulating…
Willem Melching retweeted
In 2022 we found vulnerabilities in dormakaba Saflok hotel locks. Reading one RFID card enables us to forge a pair of cards that open any door in that hotel! Dormakaba is currently working with its customers to fix the 3 million affected locks. wired.com/story/saflok-hotel…
