Am I understanding right that he essentially printed part of memory to the piezoelectric circuit in binary? How did he get his code to run to do so, or was there some other technique in play? Really interesting stuff.
I did this. You could just dd a binary to the iPods drive (with some magic numbers) and the iPod would execute it on boot. Someone figured this out for older iPods already. The USB storage mode was still available so this was quite safe.
It sounds like he already had linux running on the device, it just couldn't control/access everything, which was the ultimate goal of this project. So once you have linux running, even without being able to control everything, you have code execution. It seems like there'd be other ways to get the bootloader out, but I'm not familiar with the project, presumably he did the easiest thing he could do - or most interesting.
I think he must already have code execution, and just used this technique to dump bits of RAM.
Perhaps it it was a shellcode exploit, he maybe only had a few hundred bytes of his own code to play with, and maybe no knowledge of memory addresses needed to access 'easier' peripherals like serial UART's.
This is a total guess, but it reads to me like he physically rewired the internals of the device to connect the clicker to the CPU bus, so he could hear instructions as they were processed. Wish there were more details, though, really interesting attack!
Comments
Am I understanding right that he essentially printed part of memory to the piezoelectric circuit in binary? How did he get his code to run to do so, or was there some other technique in play? Really interesting stuff.
I did this. You could just dd a binary to the iPods drive (with some magic numbers) and the iPod would execute it on boot. Someone figured this out for older iPods already. The USB storage mode was still available so this was quite safe.
It sounds like he already had linux running on the device, it just couldn't control/access everything, which was the ultimate goal of this project. So once you have linux running, even without being able to control everything, you have code execution. It seems like there'd be other ways to get the bootloader out, but I'm not familiar with the project, presumably he did the easiest thing he could do - or most interesting.
I think he must already have code execution, and just used this technique to dump bits of RAM.
Perhaps it it was a shellcode exploit, he maybe only had a few hundred bytes of his own code to play with, and maybe no knowledge of memory addresses needed to access 'easier' peripherals like serial UART's.
This is a total guess, but it reads to me like he physically rewired the internals of the device to connect the clicker to the CPU bus, so he could hear instructions as they were processed. Wish there were more details, though, really interesting attack!
If you can physically rewire it, why not simply hook those wires up to another computer and log them...
Yeah I looked it up and the CPU was an SoC, so unlikely that this is the way he did it.
Just a guess: He had code execution but couldn't access that memory. However whatever controls that circuit could. So he used that to get to the data.