doc0 - 1.1/2.1, 1.2/2.2, 1.3/1.4

2026-10-15 11:20:05 +02:00
commit 37246f1aae
12 changed files with 134 additions and 0 deletions
@@ -0,0 +1,134 @@
+## DOCUMENT 0 - INITIAL INFORMATION GATHERING
+
+---
+
+### Installation of Custom Software
+
+TODO:
+- Check if CFW is installable
+
+---
+
+## 0.1 Services Running on the Device
+
+## 0.2 Hardware and Software Specifications
+
+## 0.3 Known Vulnerabilities / Problems / Hacks
+
+## 0.4 Collecting APKs
+
+## 1.1 && 2.1 Unpacking
+
+The packaging contains:
+- A user and safety guide
+    - The guide explains installation without any pictures but uses pictures to explain the app setup - why? 
+    - [Video installation guide](https://www.youtube.com/watch?v=ajNjStpTIlk&source_ve_path=OTY3MTQ&embeds_referring_euri=https%3A%2F%2Fembed.jotform.io%2F)
+- 8 AA batteries for power supply
+- An outdoor module (touch) 
+- Mounting HW (screws, rings, screwdrivers, ...)
+- A lock cylinder
+- A bridge
+- A motor module
+- An indoor module (the lock)
+- The shell
+
+The lock is surrounded by a plastic packaging with molds for eah component. Within the box it is kept in place with some cardboard. The box itself is held shut by a small magnet.
+
+![Contents of the box](img/unpacking.jpg)
+
+## 1.2 || 2.2 Outer Inspection
+
+### Outer Module
+
+The outer module is a touch sensor surrounded by a plastic shell with two screws and one cable inside.
+
+![Back of the touch module](img/touch_back.jpg)
+
+During installation, the cable is supposed to connect to the motor module.
+
+![Cable position of the touch module](img/touch_cable.jpg)
+
+### Inner Module
+
+The inner module includes the motor module, which is connected using cables to:
+- the power supply 
+- the touch module
+
+![The inner module including the motor module](img/inner.jpg)
+
+Unopened, it is surrounded by a metal shell which can easily be removed by pulling a plastic strap, as this is necessary during installation.
+
+### Bridge 
+
+The bridge is to be placed within 3 meters of the lock. It is used to connect the lock to the app.
+It features a reset button.
+
+![The bridge](img/bridge.jpg)
+
+## 1.3 && 1.4 Open Casing / HW Inspection
+
+### Bridge
+
+The plastic enclosure of the bridge can be opened by unscrewing two screws, revealingthe PCB. 
+
+What you can spot immediately is:
+- UART
+- ESP32 WROVER B
+    - WiFi & Bluetooth/BLE capable
+    - [Datasheet](docs/esp32_datasheet.pdf)
+
+![PCB inside the bridge](img/bridge_pcb.jpg)
+
+Under the PCB is HW for the power supply.
+
+![Power supply beneath PCB](img/bridge_under_pcb.jpg)
+
+### Outer Module
+
+There are three screws on the back of the touch module, however, it's additonally glued together. It can't be opened without being (probably) permanently damaged.
+
+![Back of the touch module with screws removed](img/touch_inside.jpg)
+
+### Inner Module
+
+As I'm working with an already opened device, I'm not interiley sure hw many screws were intially needed to open the motor module, but I'm assuming it were four. After unscrewing these the plastic shell can be removed by gently wiggling it until it comes loose.
+
+![Inside of the motor module](img/motor_inside.jpg)
+
+Once again you can immedatiely spot UART.
+
+After unplugging all cables, the PCB can be leveraged out of the shell with a flat screwdriver, without causing any damage.
+
+![Other side of the motor module PCB](img/motor_inside_2.jpg)
+
+Here you can see:
+- UART
+- $I^2C$
+- SoC and access pins
+- A buzzer and a button 
+
+## 1.5 Software Components from Firmware Analysis
+
+
+## 1.6 Collect "fresh" Firmware Dump
+
+
+## 1.7 && 2.3 Initial setup
+
+
+## 1.8 Collect Firmware Dump of Firmware after initial Setup
+
+
+## 1.9 && 2.4 Firmware Update
+
+## 1.10 Collect Updated Firmware Dump
+
+## 1.11 Collect Firmware Dump after Factory Reset
+
+## 1.12 (Optional for now) Instantiate Device Model
+
+## 1.13 Collect App APKs
+
+## 2.5 Inspection of Device During Normal Usage
+
+## 2.6 Port Scan