pd0wm · HackerTrans

pd0wm

no profile record

Submissions

Local Privilege Escalation on the DJI RM500 Smart Controller

4 pointsby pd0wm3 yıl önce0 comments

Decoding morse code using Pytorch

blog.willemmelching.nl

1 pointsby pd0wm6 yıl önce0 comments

Hacking an Audi: performing a man-in-the-middle attack on FlexRay

85 pointsby pd0wm6 yıl önce30 comments

Hacking an Audi: performing a man-in-the-middle attack on FlexRay

4 pointsby pd0wm6 yıl önce0 comments

Comma2k19 – A dataset of over 33 hours of commute in California's 280 highway

70 pointsby pd0wm8 yıl önce35 comments

comments

4 yıl öncediscuss

With modemmanager you get a lot of nice stuff for "free", like automatic reconnect, DHCP, good logging, and an APN database (useful if you don't provide your own SIMs). It also allows you to easily set up correct priorities between WiFi and LTE, both for routing and DNS. Especially DNS is something I didn't think about at first, but the DNS server provided by your LTE connection is not always reachable over your WiFi/ethernet connection.

This is the config I'm using: https://github.com/commaai/agnos-builder/blob/master/userspa...

You can run modemmanager in debug mode, which allows you to send AT commands over dbus (or mmcli) in case you still want to configure some stuff manually or get debug info.

4 yıl öncediscuss

Have you experimented with modemmanager/networkmanager to handle the configuration of the modem? For me that has worked quite reliably across a pretty large fleet of devices with a Quectel EG25 (qmi over usb).

Regarding FW updates, have you tried opening a support ticket with Quectel? For me they have been extremely responsive and helpful, providing extra documentation on special AT commands and stuff.

5 yıl öncediscuss

In this case the EPS already came stock with the functionality to request torque over CAN, that part of the code or the amount of torque was not touched. I agree it would not be a good idea to patch that functionality into an EPS that doesn't come with that from the factory.

5 yıl öncediscuss

Ghidra uses an intermediate language called p-code. When defining the CPU opcodes (and how to parse them), you also write a small snippet of p-code that represent that instruction. This makes the decompiler architecture agnostic.

Example: https://github.com/NationalSecurityAgency/ghidra/blob/master...

5 yıl öncediscuss

The XOR encryption was just for the update container. Newer update files usually employ some stronger forms of compression/encryption. However, it's usually some strange in-house crypto, so eventually people figure it out.

bri3d refers to using RSA signatures on the firmware once it's written to the flash. By ensuring the firmware is signed using the manufacturers private key it should (in theory) prevent messing with the firmware, even if all encryption/flashing steps have been reverse engineered.

Some interesting reading: https://github.com/bri3d/VW_Flash/blob/master/docs/docs.md https://github.com/jglim/UnsignedFlash

5 yıl öncediscuss

At some point the values have no deeper meaning and are just whatever VW decided on as their API. DBC files have concepts of enums, but that’s really diminishing returns and wouldn’t make the code that much easier to understand.

Also sometimes there are fixed values in the message that we’ve only observed as static data. Ironically that makes it impossible to reverse engineer what they mean. So those just have to be labeled as hardcoded value.

Those are actually magic. Those are the ECU firmware identifiers from the manufacturer that are used by openpilot to recognize which car it’s connected to.

5 yıl öncediscuss

See my other comment about Ford code being reference only.

Supported cars have most signals defined in a dbc file, the mapping from name to id and bytes. See https://github.com/commaai/opendbc

This results in much cleaner car abstraction layers: https://github.com/commaai/openpilot/blob/de0ce142ae51cf9c85...

5 yıl öncediscuss

The file you referenced is related to Ford, which is not a supported car/brand. The code for Ford is provided as a reference and is forced into “read-only” both by openpilot and panda (the bridge between openpilot and the car).

6 yıl öncediscuss

Do you have any guess on when premium processing would be brought back?

6 yıl öncediscuss

Seems like the https://www.vector.com/int/en/products/products-a-z/hardware... has some similar functionality. I have never used it, but by reading the documentation I'm not sure if it would have been useful here. The frame with ID 65 which needs be overwritten, actually contains 4 different messages indicated by the last byte in the payload. To properly time the modification you need to sync up on that, which the Vector box can't do.

Also price on request, so probably not in the price range of our target audience.

7 yıl öncediscuss

https://comma.ai/faq

7 yıl öncediscuss

Funny fact: the python round implementation actually uses strings. https://github.com/python/cpython/blob/master/Objects/floato...

7 yıl öncediscuss

It might have not been clear from my comment, but I was specifically referring to those ML as a service. The TPUs seem to fall under GCP which has a less restrictive ToS.

I do understand they don’t want to make it too easy to resell their research. But having access to all your source code, training data and documentation is a bit extreme. Why can’t they just tell you to stop selling your product?

7 yıl öncediscuss

I wonder if they will apply the same terms of service as with their Cloud Machine Learning offerings (Auto ML, Cloud Vision, etc).

A snippet from https://cloud.google.com/terms/service-terms#12-google-cloud...:

  Customer will not, and will not allow third parties to: (i) use these Services
  to create, train, or improve (directly or indirectly) a similar or competing
  product or service or (ii) integrate these Services with any applications for
  any embedded devices such as cars, TVs, appliances, or speakers without Google's
  prior written permission. These Services can only be integrated with
  applications for the following personal computing devices: smartphones, tablets,
  laptops, and desktops. In addition to any other available remedies, Google may
  immediately suspend or terminate Customer's use of these Services based on any
  suspected violation of these terms, and violation of these terms is deemed
  violation of Google's Intellectual Property Rights. Customer will provide Google
  with any assistance Google requests to reasonably confirm compliance with these
  terms (including interviews with Customer employees and inspection of Customer
  source code, model training data, and engineering documentation). These terms
  will survive termination or expiration of the Agreement.

8 yıl öncediscuss

There is a microcontroller between the phone and the car that monitors all communication and enforces safety limits. This code is written in C++.

8 yıl öncediscuss

Can you buy them for $199 in quantity?

A phone is actually a very nice and reliable piece of hardware. It has everything you need CPU, GPU, DSP, two cameras (front and back), a backup battery, a screen and wifi/lte to upload your data.