Secrets Of Simos18: REng The Secure Boot Mechanism Of An ECU
summary
Reverses the Simos18 ECU secure boot to get arbitrary code execution and full reflashing on a 2016 Golf 7R. Uses a Raspberry Pi CAN stack, Python UDS library and a custom flasher to extract a leaked firmware, find an AES key in flash, decrypt and LZSS‑decompress blocks, then exploit a logic flaw to erase cal then write app so signatures remain valid and inject a RAM payload that flips sample mode off signature checks. Also builds a bootstrap CAN loader, triggers a PWM backdoor in the supplier bootloader, breaks its weak PRNG for the 256‑byte seed, uses a CRC timing read to recover OTP flash passwords, and gains permanent flash unlock; all techniques are implemented and demonstrated.
AI-written summary · about
chapters (9)
- 0:00Introduction and objectives
- 2:26Hardware analysis
- 5:17Architecture and attack surface
- 11:00UDS protocol and flashing
- 15:31Firmware and encryption analysis
- 22:25Exploiting the customer bootloader
- 27:06Deeper access and bootstrap loading
- 31:54Supplier backdoor and RSA bypass
- 37:01Conclusion and Q&A
related talks
49mBreaking Through Another Side: Bypassing Firmware Security Boundaries from Embedded Controller
29mBackdooring of Real Time Automotive OS Devices
37mAutomatic Automotive Hacking
14mHow not to secure your embedded system, lessons from automotive testing
21mBreaking Espressif’s ESP32 V3: Program Counter Control with Computed Values using...
24mSecurity through Transparency: Tales from the RP2350 Hacking Challenge
01h 46mTutorial: Introduction to Reverse Engineering
39mBackdooring Hardware Devices by Injecting Malicious Payloads on Microcontrollers