# 054 - It's A Calibration, Not An Update!

Page: https://stenobird.com/podcast/unnamed-reverse-engineering-podcast-752753/054-it-s-a-calibration-not-an-update
Text version: https://stenobird.com/podcast/unnamed-reverse-engineering-podcast-752753/054-it-s-a-calibration-not-an-update.md
Podcast: [Unnamed Reverse Engineering Podcast](https://stenobird.com/podcast/unnamed-reverse-engineering-podcast-752753)
Published: 2022-02-11T14:50:46+00:00
Episode link: https://unnamedre.com/episode/54
Audio file: https://traffic.libsyn.com/secure/reverseengineering/054_-_Its_A_Calibration_Not_An_Update.mp3?dest-id=552832
Processing state: processed
JSON: https://stenobird.com/v1/public/podcasts/unnamed-reverse-engineering-podcast-752753/episodes/054-it-s-a-calibration-not-an-update
Duration seconds: 4583

## Resource

Willem Melching, head of openpilot at comma.ai, breaks down the technical complexities of reverse engineering automotive ECUs. The discussion covers everything from CAN bus sniffing and FlexRay man-in-the-middle attacks to using Ghidra for V850 processor analysis.

## Highlights
- Main idea: Automotive reverse engineering relies heavily on decoding bus architectures like CAN and FlexRay using DBC files
- Practical takeaway: Use Ghidra's SLEIGH language to define custom architectures, enabling decompilation for obscure processors like the V850
- Failure mode: Brute-forcing 16-bit non-volatile storage can be computationally expensive and inefficient without targeted Python scripts
- Technical insight: Modern automotive security is shifting from simple unencrypted CAN messages to complex, cryptographically signed firmware updates
- Tooling tip: Utilize software-defined oscilloscope approaches like GlScopeClient to transform analog captures into processable digital data

## Topics

Automotive Reverse Engineering, CAN Bus, FlexRay, Ghidra, Embedded Systems, Openpilot, V850 Processor, Firmware Analysis, DBC Files, Electronic Warfare

## Chapters
- 1:00 — From LEGO to Microcontrollers: Willem discusses his transition from LEGO Mindstorms to professional embedded development and C programming.
- 7:00 — Hacking the Audi FlexRay Architecture: A deep dive into performing man-in-the-middle attacks on high-speed FlexRay networks in modern Audi models.
- 18:00 — The Importance of DBC Files: Exploring how OpenDBC provides the necessary mapping of bits and bytes for automotive CAN bus communication.
- 30:00 — Brute-forcing Non-Volatile Storage: The challenges of using Python scripts to brute-force 16-bit search bases in embedded firmware.
- 36:00 — Reverse Engineering with Ghidra and SLEIGH: How to implement custom instruction set support in Ghidra to analyze V850 processor binaries.
- 59:00 — Safety and Policing in Openpilot: The role of quality management in Level 2 driving automation to prevent dangerous steering or braking commands.
- 1:10:00 — The Future of Automotive Security: Discussing the shift toward encrypted firmware and the increasing difficulty of unauthorized ECU modifications.

## Actions

- request_transcript: `POST https://stenobird.com/v1/public/podcasts/unnamed-reverse-engineering-podcast-752753/episodes/054-it-s-a-calibration-not-an-update/transcription-requests` — Idempotently request low-priority transcript generation for this episode.
- read_markdown: `GET https://stenobird.com/podcast/unnamed-reverse-engineering-podcast-752753/054-it-s-a-calibration-not-an-update.md` — Read the agent-friendly Markdown representation of this episode resource.

A page view does not enqueue transcription. Agents should invoke `request_transcript` explicitly when they need this episode processed.

## Transcript

Full transcripts are not published on public pages unless there is a clear rights basis.