Terastation hacked firmware

Then, with your shiny new screwdriver kit in hand or the one screwdriver you found in your garage open the device and examine the different chips on the board. This is what the IP camera looks like when opened up:. Device firmware lives in flash memory chips, which often have eight pins connecting it to the board.

They are also relatively small. With those clues alone, we know that the flash memory chip must be the one on the bottom side of the picture above. After some quick Googling, we determine that the chip with part number labeled MX25LF is the flash chip containing the firmware for the device.

SPI is nothing more than a protocol for communications in an embedded system. SPI allows for fast, synchronous, serial communications between different components on a board, and each pin serves a different purpose for SPI communications.

You can learn a lot about SPI and how it works here. The next step is to figure out what each pin on the chip does. Since we have identified the component number for the firmware chip, we can search for the datasheet for the chip online linked above. On page 7, we see a diagram for the chip. We want to look for the following pins so that we can connect to the chip and dump the firmware:. Alright, now the question is: how do we know which pin is which in our device? Well, see that dot on the top left corner of the chip diagram?

Look for that same dot on the chip to identify pin 1. In the previous picture, you can see the dot in the top-left corner. To dump the firmware, we need a microcontroller that can communicate with SPI chips. We have a few options, including:. To make our job more comfortable, we can use a SOIC Small Outline Integrated Circuit clip to make the connections from the flash chip to our microcontroller. A SOIC clip looks like this:. The way you use a SOIC clip is relatively simple: look for the red cable to identify the end that should make contact with pin 1 of the SPI chip.

We then hook jumper cables on the other end of the SOIC clip according to the pin numbering we determined above. Each cable, in turn, is connected to our microcontroller using the following SPI configuration:. The documentation for whatever microcontrollers you are using should indicate which pins you can use for SPI communications. In this case, we determine the above connections by locating the pin layout for the Attify Badge.

Your connections should look something like this:. Ignore the cables soldered to the chip on the top of the camera. Scroll to the firmware section and select the firmware update utility for Windows.

Once the download finishes, right-click the zip file and choose "Extract All" or use your preferred utility to un-zip the file. Once unzipped you should see the original file along with a folder by the same name. Go down through the folders until you locate the file "TSUpdater.

Double-click the file to run it. Otherwise the procedure is exactly the same. You may not see the. Case in point, the third party Xbox controller that [wrongbaud] recently decided to tear into. Though even figuring out that much took a bit of work. He had no idea what chip was powering the controller, much less that debugging protocols it might support.

But after poking around the board with his multimeter, he eventually found a few test points sitting at 3. Using just two wires data and clock , SWD provides hardware debugging capabilities on pin constrained platforms. It allows you to step through instructions, read and write to memory, even dump the firmware and flash something new.

For the rest of the post, [wrongbaud] walks the reader through working with an SWD target.