We hope that some of our readers are currently at this year’s (schedule can be found and live streams ), as many interesting talks are happening. One of them addressed embedded in all memory cards that you may have. As memory storage density increases, it’s more likely that some sectors inside the embedded flash are defective.
Therefore, all manufacturers add a small microcontroller to their cards (along with extra memory) to invisibly ‘replace’ the defective sectors to the operating system. Bunnie and xobs went around buying many different microSD cards in order to find a hackable one. In their talk at 30C3 (slides ), they reported their findings on a particular microcontroller brand, Appotech, and its AX211/AX215. By reverse engineering the firmware code they found online, they discovered a simple “knock” sequence transmitted over manufacturer-reserved commands that dropped the controller into a firmware loading mode. From there, they were able to reverse engineer most of the 8051 microcontroller function-specific registers, allowing them to develop novel applications for it. Some of the initial work was done using a FPGA/i.MX6-based platform that the team developed named, which we hope may be available for purchase some day. It was, among others, used to simulate the FLASH memory chip that the team had previously removed.
A video of the talk is embedded below. Posted in Tagged, Post navigation. Rewrite the firmware to allocate a portion of the card as “hidden”. It wouldn’t show up on a normal directory listing (or sector dump – returns contents as “empty”) unless unlocked by special program and password. Password stored on chip, so even if the wrong people get the card and program they still can’t unlock it.
You could rewrite the firmware to execute internal loops for the ones and zeroes on the card, which could be picked up by a nearby FM receiver. The card would function as a normal card, but when sent a special command would silently “sing” its contents to an eavesdropper. Yeah – too much time on their hands. None of these uses is even potentially interesting.
Busy-loop effected fsk bandwidth would be extremely low and can’t think of a scenario where introducing a hacked sd card into your target environment would be a preferable alternative, but you never know Awesome work though and very much looking forward to documented register maps and extended op-codes to be able to make use of an ultra cheep super beefed up 8051 dev board with many Gb of n/v storage. Pity the appotech manuals aren’t PD, or are they? How did bunnie get his hands on the oem firmware bootloader?
Get into pc. Kalfjd, I’m sorry my post got you angry. You will probably be getting angry more often as you grow up. You’ll find that taking a more positive approach will work better in the long run, but you’ll discover this for yourself. For an experiment, try writing some code with internal loops and play around with an FM receiver next to your computer.
See if you can get the code to make different noises on the receiver. Be sure to get your parents’ permission, though – playing around with electric things can be dangerous. That’s how the first computer generated music was done. Tech noticed that radios close to the huge systems made noises that varied depending on what the computer was doing. Someone then got the idea to write a program to deliberately make the computer produce a discernible scale of notes in it’s RFI output, then from there the next step was arranging those noise producing pieces of code into musical scales. Computer music would have taken a very different path, perhaps have had a much later start, had the EMI/RFI shielding of the early, room filling computers been much better.
Dude you should read scientific journals on cryptology and you would know that such a thing is possible, that from the sound created by a cpu or current drawn by a cpu things like that could heurestically be analyzed to great success, Few years ago there were studies with WLAN to scan environments (much like a body scanner, or the car mounted ones) these days the first wlan gesture appliances are out (control light’s with gestures etc) obviously this could be used to scan living behaviour and other shit. This brings up a question I have about making a card identify itself as having a lower capacity than what’s actually there.
My reason for asking is an older camera that will only handle a maximum of 2 gig memory card. Also I would like to use the micro SD cards as they are a lot easier to pack into a small camera bag. Plus the newer, faster class cards always seem to be only available in larger than two gigs, So there’s another hurdle. Just for giggles, I’ve tried formatting at a lower capacity or using a partition manager utility to set the size smaller. But as was expected, neither method works.:(. What I tried first was just the in house window$ format.
The thing I tried was to wipe it and repartition as a single partition as FAT16 (same FAT as camera formats to) with the rest of the card as unallocated space, by using Partition Wizard home edition 8.1.1 (freeware) Anyone got a better utility to recommend?? And Yes I’m sadly stuck with a “ghetto” budget:p – @Tom- I wodered about any difference of communication methods between the micro SD cards and a regular one, I only have micro SD cards in anything larger than the 2 gig size at the moment.
So I couldn’t try the partition util on a regular SD card. Would you figure a larger cap SD card would communicate in the needed protocol to fool the camera about card size? @Steve- Yeah the idea of making a large card show as multiples somehow, would just be bonus awesomesauce! As Tom said, the SD card format was only ever specified as far as 2GB. Presumably some field only had so many bits.
SDHC was an extension to the format, and the protocol is different. Since the protocol is programmed in at the factory, it’s presumably hard coded to only speak SDHC, whatever size the onboard flash is. It wasn’t designed to be back-compatible, unfortunately. So it’s not the size, it’s the protocol.
Formatting won’t help. They make 2GB micro-SD though. I think they still make them for the sake of all the old equipment that won’t take SDHC.
Apart from a couple of pins missing, micro / mini / normal SD are the same. The size adaptors are just bits of plastic that run the contacts through, nothing active in them. A collection of micro-SDs and an adaptor should be fine for you, often you can buy a micro-SD plus the adaptor for a couple of dollars extra. 2GB cards are really dirt cheap anyway.
It’s not that big a deal, since older cameras don’t generate files big enough to fill 2GB easily anyway.