ARM Cortex-M CPUs ship with a set of on-chip trace peripherals that most developers never touch and most reverse engineers forget exist. In this post, we'll wire up an Xbox One controller, configure the ETM and TPIU from OpenOCD, and capture a live instruction trace with nothing more than a logic analyzer and Pulseview - then use Ghidra to figure out why the trace keeps dying.

Scapy is best known as a network packet library, but it is also a general-purpose binary protocol framework. In this post, we use Scapy to dissect SPI and QSPI logic analyzer captures, trace flash erase and program operations, and reconstruct a firmware image without removing the flash chip.

Oscilloscopes, power supplies, and multimeters are all quintessential tools in the hardware hacker's toolbox. While many of us know how to configure these tools manually, I have found that security researchers often overlook the need for remote instrumentation. In this post, we'll outline some basic, practical examples of using SCPI and VISA to instrument the hardware in your lab.

In this post we discuss how to commuinicate with an unsupported chip using OpenOCD and review how to write flash programming algorithms in OpenOCD. We also demonstrate how to flash custom firmware to the target device.

In our last post, we reviewed how to use the pi-gen tool to generate an image for a Raspberry Pi that is pre-configured with many tools needed for basic hardware hacking. In this post, we will start using them on our first target.

With this post we provide an introduction to a three part series on hardware hacking and how to use a Raspberry Pi as a hardware hacking multitool. This post covers how to configure the Raspberry Pi and describes the first target that we will be using for the series

With this blog post, we'll introduce the PiFex, a basic companion board for the Raspberry Pi designed to teach users the basics of hardware hacking and embedded protocols. We will then demonstrate how to use the PiFex to access a JTAG tap on an undocumented SSD, allowing memory reads and GDB access to the SSD CPU.

As we reach the end of the year, I want to thank everyone for their continued support and business. 2023 was a great year for training and consulting. We worked with companies ranging from 4000 to 15 members, all of which brought unique perspectives to our course material and allowed us to expand on new topics and targets. A big thanks to all those who reached out for onsite training in 2023 and those who contracted with us!

One of the most common questions that I get during a training is:

“What do we need to build out an initial hardware hacking lab?”

Of course, the answer to this question can be heavily tailored based on the goals of the team and their targets, but I wanted to …

Description of the on-site course at Leahy Center