mirror of
https://github.com/mytechnotalent/Embedded-Hacking.git
synced 2026-06-02 04:21:39 +02:00
Update WEEK06
This commit is contained in:
Kevin Thomas
+23
-26
@@ -1,6 +1,6 @@
|
||||
# 📘 Week 9: Operators in Embedded Systems: Debugging and Hacking Operators w/ DHT11 Temperature & Humidity Sensor Single-Wire Protocol Basics.
|
||||
# Week 9: Operators in Embedded Systems: Debugging and Hacking Operators w/ DHT11 Temperature & Humidity Sensor Single-Wire Protocol Basics.
|
||||
|
||||
## 🎯 What You'll Learn This Week
|
||||
## What You'll Learn This Week
|
||||
|
||||
By the end of this tutorial, you will be able to:
|
||||
- Understand all six types of C operators (arithmetic, increment, relational, logical, bitwise, assignment)
|
||||
@@ -380,7 +380,7 @@ Embedded-Hacking/
|
||||
|
||||
---
|
||||
|
||||
## 🔧 Part 11: Hands-On Tutorial - The Operators Code
|
||||
## Part 11: Hands-On Tutorial - The Operators Code
|
||||
|
||||
### Step 1: Review the Source Code
|
||||
|
||||
@@ -485,18 +485,14 @@ Humidity: 51.0%, Temperature: 23.8 deg C
|
||||
|
||||
---
|
||||
|
||||
## 🐛 Part 12: Debugging with GDB
|
||||
## Part 12: Debugging with GDB
|
||||
|
||||
### Step 5: Start OpenOCD (Terminal 1)
|
||||
|
||||
Open a terminal and start OpenOCD:
|
||||
|
||||
```powershell
|
||||
openocd ^
|
||||
-s "C:\Users\assem.KEVINTHOMAS\.pico-sdk\openocd\0.12.0+dev\scripts" ^
|
||||
-f interface/cmsis-dap.cfg ^
|
||||
-f target/rp2350.cfg ^
|
||||
-c "adapter speed 5000"
|
||||
```cmd
|
||||
openocd -s "%USERPROFILE%\.pico-sdk\openocd\0.12.0+dev\scripts" -f interface/cmsis-dap.cfg -f target/rp2350.cfg -c "adapter speed 5000"
|
||||
```
|
||||
|
||||
You should see output indicating OpenOCD connected successfully to your Pico 2 via the Debug Probe.
|
||||
@@ -505,7 +501,7 @@ You should see output indicating OpenOCD connected successfully to your Pico 2 v
|
||||
|
||||
Open a **new terminal** and launch GDB with the binary:
|
||||
|
||||
```powershell
|
||||
```cmd
|
||||
arm-none-eabi-gdb build\0x001a_operators.elf
|
||||
```
|
||||
|
||||
@@ -514,7 +510,7 @@ arm-none-eabi-gdb build\0x001a_operators.elf
|
||||
Inside GDB, type:
|
||||
|
||||
```
|
||||
target remote :3333
|
||||
target extended-remote :3333
|
||||
```
|
||||
|
||||
This connects GDB to OpenOCD.
|
||||
@@ -640,13 +636,13 @@ The program will loop, printing values to serial.
|
||||
|
||||
---
|
||||
|
||||
## 🔧 Part 13: Setting Up Ghidra for Analysis
|
||||
## Part 13: Setting Up Ghidra for Analysis
|
||||
|
||||
### Step 17: Start Ghidra
|
||||
|
||||
Open a terminal and type:
|
||||
|
||||
```powershell
|
||||
```cmd
|
||||
ghidraRun
|
||||
```
|
||||
|
||||
@@ -686,7 +682,7 @@ Wait for analysis to complete.
|
||||
|
||||
---
|
||||
|
||||
## 🔍 Part 14: Finding the Reset_Handler
|
||||
## Part 14: Finding the Reset_Handler
|
||||
|
||||
### Step 22: Understand the Vector Table
|
||||
|
||||
@@ -773,7 +769,7 @@ Look at the end of Reset_Handler for three function calls. The middle one is `ma
|
||||
|
||||
---
|
||||
|
||||
## 🔍 Part 15: Resolving Functions in Ghidra
|
||||
## Part 15: Resolving Functions in Ghidra
|
||||
|
||||
### Step 28: Resolve stdio_init_all
|
||||
|
||||
@@ -859,7 +855,7 @@ bl FUN_xxxxx ; puts
|
||||
|
||||
---
|
||||
|
||||
## 🔬 Part 16: Understanding IEEE-754 Floating-Point
|
||||
## Part 16: Understanding IEEE-754 Floating-Point
|
||||
|
||||
### What is IEEE-754?
|
||||
|
||||
@@ -927,7 +923,7 @@ print(f"Bytes: {encoded.hex()}") # 0000 80bf
|
||||
|
||||
---
|
||||
|
||||
## 🔍 Part 17: Finding the Temperature Hack Point
|
||||
## Part 17: Finding the Temperature Hack Point
|
||||
|
||||
### Step 34: Locate the dht11_read Function
|
||||
|
||||
@@ -972,7 +968,7 @@ Make note of these offsets in the binary file:
|
||||
|
||||
---
|
||||
|
||||
## ✏️ Part 18: Manual Hacking in Ghidra
|
||||
## Part 18: Manual Hacking in Ghidra
|
||||
|
||||
### Step 37: Open the Bytes Editor
|
||||
|
||||
@@ -1011,7 +1007,7 @@ print(f"New: {new}") # 5.0
|
||||
|
||||
---
|
||||
|
||||
## 🚀 Part 19: Exporting and Testing
|
||||
## Part 19: Exporting and Testing
|
||||
|
||||
### Step 41: Export the Patched Binary
|
||||
|
||||
@@ -1025,7 +1021,7 @@ print(f"New: {new}") # 5.0
|
||||
|
||||
Open a terminal and run:
|
||||
|
||||
```powershell
|
||||
```cmd
|
||||
cd C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x001a_operators
|
||||
python ..\uf2conv.py build\0x001a_operators-h.bin --base 0x10000000 --family 0xe48bff59 --output build\hacked.uf2
|
||||
```
|
||||
@@ -1040,7 +1036,7 @@ You should see dramatically increased temperature readings!
|
||||
|
||||
---
|
||||
|
||||
## 📊 Part 20: Summary and Review
|
||||
## Part 20: Summary and Review
|
||||
|
||||
### What We Accomplished
|
||||
|
||||
@@ -1084,7 +1080,7 @@ You should see dramatically increased temperature readings!
|
||||
|
||||
---
|
||||
|
||||
## 💡 Key Takeaways
|
||||
## Key Takeaways
|
||||
|
||||
1. **Post-increment returns the OLD value** - `x++` gives you x, THEN adds 1
|
||||
|
||||
@@ -1106,7 +1102,7 @@ You should see dramatically increased temperature readings!
|
||||
|
||||
---
|
||||
|
||||
## 📖 Glossary
|
||||
## Glossary
|
||||
|
||||
| Term | Definition |
|
||||
| ------------------ | --------------------------------------------------- |
|
||||
@@ -1131,7 +1127,7 @@ You should see dramatically increased temperature readings!
|
||||
|
||||
---
|
||||
|
||||
## 📚 Additional Resources
|
||||
## Additional Resources
|
||||
|
||||
### IEEE-754 Float Quick Reference
|
||||
|
||||
@@ -1158,7 +1154,7 @@ You should see dramatically increased temperature readings!
|
||||
|
||||
---
|
||||
|
||||
## 🌍 Real-World Implications
|
||||
## Real-World Implications
|
||||
|
||||
### Why This Matters
|
||||
|
||||
@@ -1188,3 +1184,4 @@ By manipulating sensor readings, an attacker could:
|
||||
Happy hacking! ?
|
||||
|
||||
|
||||
|
||||
|
||||
Reference in New Issue
Block a user