umiushi in the house

This time, I'd like to try monitoring smartlock's BLE packets with Ubertooth One. Smartlock  use this dongle and Ubertooth One Find BLE device  check BLE dongle is connected. ➜ ~ sudo hciconfig hci0: Type: BR/EDR Bus: USB BD Address: 00:1A:7D:DA:71:13 ACL MTU: 310:10 SCO MTU: 64:8 UP RUNNING PSCAN RX bytes:622 acl:0 sco:0 events:38 errors:0 TX bytes:952 acl:0 sco:0 commands:38 errors:0 Let's find BLE devices ➜ ~ sudo hcitool lescan LE Scan ... 30:F8:3F:06:4F:6F (unknown) 30:F8:3F:06:4F:6F (unknown) 30:F8:3F:06:4F:6F (unknown) 18:62:E4:46:60:AB (unknown) Then, trying gatttool. Peripheral is defined by service and characteristic. Each service contains charateristics which contains data. ➜ ~ sudo gatttool -I -b 18:62:E4:46:60:AB [ ][18:62:E4:46:60:AB][LE]> connect [CON][18:62:E4:46:60:AB][LE]> primary [CON][18:62:E4:46:60:AB][LE]> attr handle: 0x0001, end grp handle: 0x0008 uuid: 0000fee7-0000-1000-8000-00805f9b34fb attr handle: 0x0009, en...

I tried firmware dumping via SPI with Attify badge and Attify OS. Target camera is this one.. This camera seems to be famous among the IoT hackers. You would find many IoT hacking blogs about this camera. After the preview, I have extracted board. This time, I'd like to focus on Flash memory. It looks mxic mx25l12835f. From model number, we can find data-sheet. MX25L12835F . Now, let's connect flash memory pin and Attify Badge. Attify badge pin layout is.. D0 : SCK D1 : MISO  D2 : MOSI  D3 : CS  I have connected flash memory and Attify badge like this. D0 - SCLK(6) D1 - SI(5)  D2 - SO(2)  D3 - CS(1)  GND - GND(4)  3.3V - VCC(8)  3.3V - RESET(7)  3.3V - WP(3)  We dont need to connect power plug to camera. It is supplied via badge. For testing, trying spiflash.py and -i parameter. According to the python code, it returns ChipID. This command can be used for connectivity tesingt. "00 00 00" or "FF FF...

I bought Attify's IoT Exploit lerning kit . Since that was soooo fun, I want to show you some. Zigbee sniffing with APImote Zigbee is a global standard for wireless technology which supports low cost, highly reliable networks for device-to-device communication. In the lerning kit, APImote enables to monitor zigbee packets. Following tools are used for hands-on demo. All of these tools are included in the IoT Exploit learning kit. (Since I bought this kit in beginning of 2019, contents may be changed.) And also we can use VM image that required tools are installed. https://github.com/adi0x90/attifyos Upload code to Arduino Nano Let's upload code to Arduino Nano with Arduino IDE. It just sending text and counting up value. #include int a=0; SoftwareSerial mySerial(2,3); //RX, TX void setup(){ Serial.begin(2400); //baudrate: 2400bps } void loop(){ Serial.println("Hello!!!"); Serial.println(a); a++; } For just in case, check if it ...

I tried to boot Raspbian OS on Qemu but failed!! Ubuntu 16.04 + Qemu + Raspberry Pi image Freeing unused kernel memory: 176K (c0530000 - c055c000) Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000004 I googled it and resolved.. It need to edit raspberry pi's files in .img /etc/fstab by commenting out mmcblk entries and /etc/ld.so.preload old entries. OK, lets check .img file. umiushi@umiushi-VirtualBox:~/Desktop/armv6_stretch$ file raspbian-stretch.img raspbian-stretch.img: DOS/MBR boot sector; partition 1 : ID=0xc, start-CHS (0x0,130,3), end-CHS (0x7,165,30), startsector 8192, 114688 sectors; partition 2 : ID=0x83, start-CHS (0x7,165,31), end-CHS (0x18e,97,19), startsector 122880, 6277120 sectors Then, trying fdisk command. Which sector should be mounted.. umiushi@umiushi-VirtualBox:~/Desktop/armv6_stretch$ fdisk -l ./raspbian-stretch.img Disk ./raspbian-stretch.img: 3.1 GiB, 3276800000 bytes, 6400000 sectors Units: sectors of 1 * 512 = 512 by...