Drone Hacking Part 1: Dumping Firmware and Bruteforcing ECC

[Neywiny]

Great work.

Seems like a typo when covering inversion. They claim parity(0) = 0 but still use the equation with != from before.

It's nice to see that they, like me, subscribe to "an hour of experimenting can save 5 minutes of reading the documentation." Of course what people often fail to realize is that until you've found the answer, you often don't realize what the documentation was saying, such as the 16-bit thing. Management may ask "was that not in the manual?" But it's more nebulous than that.

[gessha]

I bet you that one hour was full of excitement, where’s the fun in reading the documentation :P

Another great to look at it is possibly as a TDD approach vs analyzing the problem at a deeper level.

[purplehat_]

For anyone else who got a little too excited at the title, ECC here is error correction codes, not elliptic curve crypto.

Very cool writeup, thanks for digging into all those data sheets and sharing it with us! I feel like the hands-on electronics stuff has always been a little bit inaccessible to me, but posts like these always make me a little more excited to start doing little projects myself. So thanks for posting.

[aenis]

Fantastic and inspiring write up, big thanks!

Here is to hoping someone will do something similar for DRM'ed BOSCH ebike motors.

[stavros]

Be the change you want to see in the world.

[mschuster91]

> Here is to hoping someone will do something similar for DRM'ed BOSCH ebike motors.

Please not. Bike thieves are already annoying as they are (a ring in the rural city I live in managed to steal over 400 k€ worth of bikes in a matter of months, in my case they only stole the control unit), and so are people modding their bikes to run (way) faster than the legal limit, leading to more and more calls for them being banned off of normal bike tracks.

[1] https://www.idowa.de/regionen/landshut/landkreis-landshut/se...

[oulipo2]

We do it at https://infinite-battery.com :) our battery is compatible with Gen2/Gen3/Gen4 (we haven't yet tested on smart systems though)

[dextrous]

Thanks very much for this awesome write up! It’s detailed labor-of-love work like this that helps others (like me!) make great jumps in learning. So appreciated.

[mschuster91]

And as usual... something that looks like it uses Linux, but has absolutely zero Google search results on how to obtain the GPL sources.

We desperately need some large ass legal fund that takes the GPL violators to court.

[smokel]

If they use unmodified Linux, then they only have to provide (a link to) the source code to that kernel on request. No source code is required for proprietary add-ons, unless they are kernel modifications.

The GPL also does not state that the source code should be easy to find. In the early days, one had to write a letter, send it by mail, in hopes of getting a tape or CD-ROM with the source code. For which you then had to pay as well.

[wuschel]

What could be the potential risk of not being compliant to the software license at hand e.g. let us say we would sue a GPL violator?

[nerdsniper]

What a beautiful write-up! This is such a lovely resource for anyone who ever has the curiosity of "I'm interested in getting a firmware dump".

[syntaxing]

Fun read! How long does the script take to run? I’m curious if you would have noticed any performance increase if you wrote it in C++.

[eimrine]

Drane Hacking next: bypassing Radio Electronic Warfare.

[speed_spread]

Dead Reckoning + Physical Media + Return to Base

[MPSimmons]

Damn, I really enjoyed reading this. Great writeup!

[vachina]

Now do DJI next

[duttybear]

Bruteforcing ecc is the Services may subject to the contrary. My vision of brutforcing is droning below sea levels, .