commit 37246f1aae29873933cca6b6ada29fcab9047c13 Author: a.edenhauser Date: Thu Oct 15 11:20:05 2026 +0200 doc0 - 1.1/2.1, 1.2/2.2, 1.3/1.4 diff --git a/Document0-Initial_Information_Gathering.md b/Document0-Initial_Information_Gathering.md new file mode 100644 index 0000000..de28e3a --- /dev/null +++ b/Document0-Initial_Information_Gathering.md @@ -0,0 +1,134 @@ +## DOCUMENT 0 - INITIAL INFORMATION GATHERING + +--- + +### Installation of Custom Software + +TODO: +- Check if CFW is installable + +--- + +## 0.1 Services Running on the Device + +## 0.2 Hardware and Software Specifications + +## 0.3 Known Vulnerabilities / Problems / Hacks + +## 0.4 Collecting APKs + +## 1.1 && 2.1 Unpacking + +The packaging contains: +- A user and safety guide + - The guide explains installation without any pictures but uses pictures to explain the app setup - why? + - [Video installation guide](https://www.youtube.com/watch?v=ajNjStpTIlk&source_ve_path=OTY3MTQ&embeds_referring_euri=https%3A%2F%2Fembed.jotform.io%2F) +- 8 AA batteries for power supply +- An outdoor module (touch) +- Mounting HW (screws, rings, screwdrivers, ...) +- A lock cylinder +- A bridge +- A motor module +- An indoor module (the lock) +- The shell + +The lock is surrounded by a plastic packaging with molds for eah component. Within the box it is kept in place with some cardboard. The box itself is held shut by a small magnet. + +![Contents of the box](img/unpacking.jpg) + +## 1.2 || 2.2 Outer Inspection + +### Outer Module + +The outer module is a touch sensor surrounded by a plastic shell with two screws and one cable inside. + +![Back of the touch module](img/touch_back.jpg) + +During installation, the cable is supposed to connect to the motor module. + +![Cable position of the touch module](img/touch_cable.jpg) + +### Inner Module + +The inner module includes the motor module, which is connected using cables to: +- the power supply +- the touch module + +![The inner module including the motor module](img/inner.jpg) + +Unopened, it is surrounded by a metal shell which can easily be removed by pulling a plastic strap, as this is necessary during installation. + +### Bridge + +The bridge is to be placed within 3 meters of the lock. It is used to connect the lock to the app. +It features a reset button. + +![The bridge](img/bridge.jpg) + +## 1.3 && 1.4 Open Casing / HW Inspection + +### Bridge + +The plastic enclosure of the bridge can be opened by unscrewing two screws, revealingthe PCB. + +What you can spot immediately is: +- UART +- ESP32 WROVER B + - WiFi & Bluetooth/BLE capable + - [Datasheet](docs/esp32_datasheet.pdf) + +![PCB inside the bridge](img/bridge_pcb.jpg) + +Under the PCB is HW for the power supply. + +![Power supply beneath PCB](img/bridge_under_pcb.jpg) + +### Outer Module + +There are three screws on the back of the touch module, however, it's additonally glued together. It can't be opened without being (probably) permanently damaged. + +![Back of the touch module with screws removed](img/touch_inside.jpg) + +### Inner Module + +As I'm working with an already opened device, I'm not interiley sure hw many screws were intially needed to open the motor module, but I'm assuming it were four. After unscrewing these the plastic shell can be removed by gently wiggling it until it comes loose. + +![Inside of the motor module](img/motor_inside.jpg) + +Once again you can immedatiely spot UART. + +After unplugging all cables, the PCB can be leveraged out of the shell with a flat screwdriver, without causing any damage. + +![Other side of the motor module PCB](img/motor_inside_2.jpg) + +Here you can see: +- UART +- $I^2C$ +- SoC and access pins +- A buzzer and a button + +## 1.5 Software Components from Firmware Analysis + + +## 1.6 Collect "fresh" Firmware Dump + + +## 1.7 && 2.3 Initial setup + + +## 1.8 Collect Firmware Dump of Firmware after initial Setup + + +## 1.9 && 2.4 Firmware Update + +## 1.10 Collect Updated Firmware Dump + +## 1.11 Collect Firmware Dump after Factory Reset + +## 1.12 (Optional for now) Instantiate Device Model + +## 1.13 Collect App APKs + +## 2.5 Inspection of Device During Normal Usage + +## 2.6 Port Scan diff --git a/docs/esp32_datasheet.pdf b/docs/esp32_datasheet.pdf new file mode 100644 index 0000000..e0d4667 Binary files /dev/null and b/docs/esp32_datasheet.pdf differ diff --git a/img/bridge.jpg b/img/bridge.jpg new file mode 100644 index 0000000..09b9af6 Binary files /dev/null and b/img/bridge.jpg differ diff --git a/img/bridge_pcb.jpg b/img/bridge_pcb.jpg new file mode 100644 index 0000000..9358143 Binary files /dev/null and b/img/bridge_pcb.jpg differ diff --git a/img/bridge_under_pcb.jpg b/img/bridge_under_pcb.jpg new file mode 100644 index 0000000..b158aff Binary files /dev/null and b/img/bridge_under_pcb.jpg differ diff --git a/img/inner.jpg b/img/inner.jpg new file mode 100644 index 0000000..5f9b15b Binary files /dev/null and b/img/inner.jpg differ diff --git a/img/motor_inside.jpg b/img/motor_inside.jpg new file mode 100644 index 0000000..b616f39 Binary files /dev/null and b/img/motor_inside.jpg differ diff --git a/img/motor_inside_2.jpg b/img/motor_inside_2.jpg new file mode 100644 index 0000000..0d0ffe2 Binary files /dev/null and b/img/motor_inside_2.jpg differ diff --git a/img/touch_back.jpg b/img/touch_back.jpg new file mode 100644 index 0000000..c2a63c2 Binary files /dev/null and b/img/touch_back.jpg differ diff --git a/img/touch_cable.jpg b/img/touch_cable.jpg new file mode 100644 index 0000000..3a97515 Binary files /dev/null and b/img/touch_cable.jpg differ diff --git a/img/touch_inside.jpg b/img/touch_inside.jpg new file mode 100644 index 0000000..fda27d1 Binary files /dev/null and b/img/touch_inside.jpg differ diff --git a/img/unpacking.jpg b/img/unpacking.jpg new file mode 100644 index 0000000..6e07a60 Binary files /dev/null and b/img/unpacking.jpg differ