Firmware extraction

[Shantanu Khandelwal]

Hi Null,

Everyone of us has seen the BADUSB talk at Defcon, It discusses about the vulnerabilities that lie at the USB firmware . They provided us with the tools to extract firmware from USB .

I was thinking is there a way to extract firmware from any HID device, a standard way to do that ?

Best

Shantanu Khandelwal

[Syed Anwaarullah]

You'd need to determine which Microcontroller is there on the HID device and then lookup methods to extract the firmware from it. Most Microcontrollers have lock bits that prevent firmware from being extracted (though folks around have found ways to break that as well). 

Given the fact that there are hundreds of Microcontroller families(8051, ARM, AVR etc to name a few), a universal extractor might be difficult. BadUSB is based off flash drives that have a Phison controller based off the 8051 uC as the core. Other HID devices having a different controller chipset might not be affected by BadUSB (unless, there's a universal extractor that first determines what uC is onboard and then plays around ;) ).

Some reference links:

1. https://github.com/adamcaudill/Psychson

2. https://github.com/adamcaudill/Psychson/wiki/Known-Supported-Devices (mostly Phison based flash drives)

3. http://arstechnica.com/civis/viewtopic.php?f=2&t=1251311&start=240

4. http://www.theregister.co.uk/2014/07/31/black_hat_hackers_drive_truck_through_hole_in_usb_security/

5. http://www.slideshare.net/xabean/controlling-usb-flash-drive-controllers-expose-of-hidden-features

​

​​

​Hope that answers your question.​

Syed Anwaarullah

+91-990-88-777-64

anwaarullah.com

--
______________________________________________________________________________
null - Spreading the right Information
null Mailing list charter: http://null.co.in/section/about/null_list_charter/
______________________________________________________________________________
Do you trust your hardware?
http://hardwear.io
---
You received this message because you are subscribed to the Google Groups "null" group.
To unsubscribe from this group and stop receiving emails from it, send an email to null-co-in+...@googlegroups.com.
Visit this group at https://groups.google.com/group/null-co-in.
For more options, visit https://groups.google.com/d/optout.