add: REA analysis
This commit is contained in:
@@ -209,16 +209,13 @@ pipx run --spec esptool==3.3.2 esptool.py -p /dev/ttyUSB1 -b 115200 read_flash 0
|
||||
|
||||
> Writing this down in case I need it again.
|
||||
|
||||
#### FW Analysis
|
||||
|
||||
I found an [IoT FW analysis tool](https://github.com/ericyoc/iot_device_firmware_analysis_poc/tree/main) on GitHub, which I used for generating a quick [report](firmware/bridge/report.txt).
|
||||
Interesting findings:
|
||||
- Lock state tracking (`GO_TO_STATE_INSTANTOPEN`, `MOTOR_STALL`, ...)
|
||||
- Confirmed cloud communication via MQTT and lock communication via BLE
|
||||
- Contains embedded RSA and EC Private Key structural markers
|
||||
- Implements `secure_boot_v1`
|
||||
- Uses `mbedtls` for modern ciphers
|
||||
- Exposes path from dev's machine (his name seems to be Pierre, lol) `/home/pierre/bridge/components/button_driver/iot_button.c`
|
||||
- Runs FreeRTOS
|
||||
- Uses SPIRAM
|
||||
|
||||
##### Reverse Engineer Anything
|
||||
|
||||
Using [REA](https://github.com/morluto/rea), we ran the firmware through Claude Code and received a short [report](firmware/bridge/claude_firmware_analysis.md).
|
||||
|
||||
### Inner Module
|
||||
|
||||
|
||||
Reference in New Issue
Block a user