Episode
054 - It's A Calibration, Not An Update!
- Published
- Feb 11, 2022
- Duration seconds
- 4583
- Processing state
processed- Canonical source
- https://unnamedre.com/episode/54
Actions
POST https://stenobird.com/v1/public/podcasts/unnamed-reverse-engineering-podcast-752753/episodes/054-it-s-a-calibration-not-an-update/transcription-requests
Idempotently request low-priority transcript generation for this episode.GET https://stenobird.com/podcast/unnamed-reverse-engineering-podcast-752753/054-it-s-a-calibration-not-an-update.md
Read the agent-friendly Markdown representation of this episode resource.
Summary
Willem Melching, head of openpilot at comma.ai, breaks down the technical complexities of reverse engineering automotive ECUs. The discussion covers everything from CAN bus sniffing and FlexRay man-in-the-middle attacks to using Ghidra for V850 processor analysis.
Topics
- Automotive Reverse Engineering
- CAN Bus
- FlexRay
- Ghidra
- Embedded Systems
- Openpilot
- V850 Processor
- Firmware Analysis
- DBC Files
- Electronic Warfare
Highlights
- Main idea: Automotive reverse engineering relies heavily on decoding bus architectures like CAN and FlexRay using DBC files
- Practical takeaway: Use Ghidra's SLEIGH language to define custom architectures, enabling decompilation for obscure processors like the V850
- Failure mode: Brute-forcing 16-bit non-volatile storage can be computationally expensive and inefficient without targeted Python scripts
- Technical insight: Modern automotive security is shifting from simple unencrypted CAN messages to complex, cryptographically signed firmware updates
- Tooling tip: Utilize software-defined oscilloscope approaches like GlScopeClient to transform analog captures into processable digital data
Chapters
1:00From LEGO to Microcontrollers: Willem discusses his transition from LEGO Mindstorms to professional embedded development and C programming.7:00Hacking the Audi FlexRay Architecture: A deep dive into performing man-in-the-middle attacks on high-speed FlexRay networks in modern Audi models.18:00The Importance of DBC Files: Exploring how OpenDBC provides the necessary mapping of bits and bytes for automotive CAN bus communication.30:00Brute-forcing Non-Volatile Storage: The challenges of using Python scripts to brute-force 16-bit search bases in embedded firmware.36:00Reverse Engineering with Ghidra and SLEIGH: How to implement custom instruction set support in Ghidra to analyze V850 processor binaries.59:00Safety and Policing in Openpilot: The role of quality management in Level 2 driving automation to prevent dangerous steering or braking commands.1:10:00The Future of Automotive Security: Discussing the shift toward encrypted firmware and the increasing difficulty of unauthorized ECU modifications.