@jamchamb_

security research and reverse engineering | security consultant | @jamchamb@infosec.exchange

 Brooklyn, NY
jamchamb.net
Joined January 2011
  • Tweets136
  • Following474
  • Followers1.2K
37Media
New writeup on finding the abandoned NES emulator features in Animal Crossing and using them to get code execution via memory card: jamchamb.github.io/2018/07/1…

Finding and exploiting hidden features of Animal Crossing's NES emulator

While looking for ways to activate the developer menus left over in Animal Crossing,including the NES emulator game selection menu, I found an interesting fe...

jamchamb.net
17
362
51
1,004
Disclosure is finally up for some vulns in the ESP32 BluFi reference app: nccgroup.com/us/research-blo… most interesting bug to me is the DH public key calculation buffer overflow.
1
4
23
1,592
Despite providing proof of concept exploits and multiple rounds of feedback on patches, Espressif refused to acknowledge the memory corruption bugs as security vulnerabilities and won't be issuing any advisories.
8
376
Uploaded the slides for "Reverse Engineering the PowerG Wireless Protocol" @reconmtl cfp.recon.cx/media/recon2024…
2
8
27
3,518
Checkout the new NanoMIPS plugin/blog post that aided in reverse engineering a Mediatek-based 5G modem image! research.nccgroup.com/2024/0… #cybersecurity #infosec #tech
2
7
23
6,545
If you want to reverse some MediaTek 5G baseband firmware, we're open sourcing our nanoMIPS Ghidra module: research.nccgroup.com/2024/0…
2
44
2
156
15,185
Wrote an overview of using the different Ghidra decompiler simplification styles for P-Code analysis, how to trace the decompilation process, and getting around some issues with analyzing stack write operations. Even used a bug in Ghidra to alter the analysis configuration :)
NCC Group Research & Technology@NCCGroupInfosec20 May 2022
Blog: earlyremoval, in the Conservatory, with the Wrench: Exploring Ghidra’s decompiler internals to make automatic P-Code analysis scripts - research.nccgroup.com/2022/0… - by James Chambers
1
14
38
Tool Release: Ghostrings - a collection of Ghidra scripts for recovering string definitions in Go binaries with P-Code analysis - by James Chambers - research.nccgroup.com/2022/0… - Code - github.com/nccgroup/ghostrin…
1
105
1
243
Main demo video for the Snap Station talk
2
9
I've posted some notes on how the Snap Station protocol works and released the code for the iCEBreaker JoyBus device jamchamb.net/2021/08/17/snap…

Reversing the Pokémon Snap Station without a Snap Station

Back in 1999 when the original Pokémon Snap was released for the Nintendo 64, one of its coolest features was that you could print out the photos you took in...

jamchamb.net
3
18
1
41
I've been reverse engineering Pokemon Snap (N64) to restore the Blockbuster sticker printing kiosk functionality without the kiosk, finally made some good breakthroughs
Print button enabled in Pokemon Snap Gallery menu

ALT Print button enabled in Pokemon Snap Gallery menu

Bootup gallery display for sticker printing

ALT Bootup gallery display for sticker printing

2
17
3
119
Implemented this in an emulator as well, here's the overall flow. (In the real kiosk the printer would sync video screen captures with the console for the images displayed after reboot.)
1
16
I only recently found out the 2010 HOPE badge was also a GoodFET, but I did distinctly remember there was some kind of puzzle hidden in the firmware. In keeping with doing this 11 years late, I dumped the firmware with a GreatFET and found some ciphertext and a raw RGB565 image
2
11
Got some basic N64 controller functionality working on an FPGA :) I've been wanting to try this for a while
15
Dumping K360 wireless keyboard firmware with a GreatFET jamchamb.net/2021/05/29/dump…

Dumping K360 wireless keyboard firmware with a GreatFET

I recently decided to do some keyboard hacking for fun, so I started withone of the cheapest Logitech wireless keyboard models available: the K360.This model...

jamchamb.net
4
Awesome🤩 @jamchamb_ wrote a writeup about my Maze game hacking challenge :3 jamchamb.github.io/2020/06/2…
21
143
James Chambers retweeted
CTurt@CTurtE3 May 2020
shogihax - Remote Code Execution on Nintendo 64 through Morita Shogi 64: cturt.github.io/shogihax.htm…
12
161
10
445
James Chambers retweeted
waneella@waneella_29 Mar 2020
🎶 youtu.be/PSBjS2xppec
5
212
5
839
Just realized I can hook my switch into my NTS-1
1
10
I've had some afl-unicorn optimizations sitting around that I figured I'd share, they help with startup time when you have many memory segments. A target w/ ~2500 segments would take about 11 minutes to start, these changes took it down to a few seconds: github.com/jamchamb/afl-unic…
1
1
3
The long startup time was basically caused by: 1. Inefficient algorithms for mem mapping 2. Not using qemu memory transactions So each time a segment was added, the entire address space was recalculated, running inefficient algo. many times.
1
Load more