Reversing a Brake ECU Firmware Update
summary
Reverse engineering of the ID9363 updater extracts firmware from three EC80 Brake ECUs using the S12X background debug module and IDA Pro, then automates differential binary analysis with Qbindiff to show 100–120 functions removed by the update. Analysis finds four patched vulnerabilities—buffer overflows, out‑of‑bounds writes including a write‑where primitive, DoS and RCE—validated on a bench and in a moving truck where exploitation disrupts speedometer, dynamic steering and automatic shifting; fixes align firmware to updated J2497 guidance.
AI-written summary · about
chapters (13)
- 0:00Truck ECU hacking context
- 1:38Brake ECU role in trucks
- 4:47Prior work and silent patches
- 5:49Recall and updater details
- 7:14Reverse engineering update
- 10:01Bootloader and app regions
- 11:25RAM reconstruction
- 12:49Flash write anomalies in S12X
- 13:31Automated pipeline findings
- 14:34J2497 handling flaws
- 15:17ECU crashes and ABS denial
- 16:45Safety update security impact
- 17:05Acknowledgements
related talks
49mBreaking Through Another Side: Bypassing Firmware Security Boundaries from Embedded Controller
41mSecrets Of Simos18: REng The Secure Boot Mechanism Of An ECU
20mSecurity and Safety in the Modern Vehicles
44mMy Car, My Keys: Obtaining CAN Bus SecOC Signing Keys
37mAutomatic Automotive Hacking
01h 04mAnalyzing UEFI BIOSes from Attacker & Defender Viewpoints
50mAdvanced CAN Injection Techniques for Vehicle Networks
41mKeynote Presentation: Ten Years After the Jeep Hack: A Retrospective on...