Research
Reverse engineering write-ups
Write-ups of our reverse engineering and vulnerability research, mostly on consumer products, along with the tooling developed to support it.
Some of this research is self-directed: products are purchased and tested on our own equipment. We publish write-ups of the findings, not the raw research data.
ESP32 / ESP-IDF
ESP32 Reverse Engineering Toolchain
A Ghidra toolchain built for ESP32 firmware: flash loader, flash-dump parser, and type and function-signature archives for ESP-IDF v2.0 through v5.1.
Ghidra / Tensilica Xtensa
Xtensa Processor Support for Ghidra
A processor module that lets Ghidra disassemble and decompile Tensilica Xtensa, the architecture behind ESP8266 and ESP32 chips. Shipped upstream in Ghidra 11.0.
Ford F-150 (2021)
In preparation2021 Ford F-150 ECU Firmware
Extraction and analysis of the firmware update packages for the electronic control units in a 2021 Ford F-150.
Frameo 32-inch frame (CLINK DP105L, RK3326)
In preparationFrameo Digital Photo Frame
Recovery and analysis of a 32-inch Android photo frame built on a Rockchip RK3326, documenting a methodology that applies to similar devices.
Volkswagen Golf Mk6 / openpilot
In preparationopenpilot on a Volkswagen Golf
A 2019 hardware retrofit that ran comma's open source openpilot on a 2014 Volkswagen Golf TDI by adding the radar and CAN gateway the car lacked.