Post · Kakapo Social

But I took a quick look anyway.
Using a #UDS database, I did a little poking against the FBS4 methods like personalization or activation, but the BSG only sends some cryptic CAN messages to the EIS ECU (ignition switch module). And since I obviously don't have an EIS, the UDS calls just fail.
I've figured out the message structure of the messages between the BSG and the EIS for the most part, but without knowing what they're even negotiating, it's pretty much a dead end, I'm afraid.

LeoDJ

@LeoDJ@chaos.social · 2 years ago

So in January, I tried to dump the firmware, with moderate confidence of success.
In the #UDS database, there obviously wasn't any method defined for downloading the firmware, only uploading.
But I played around with the default downloading commands anyways, although with no success.
So I tried other methods of obtaining the firmware:

LeoDJ

@LeoDJ@chaos.social · 2 years ago

There is the CAN #XCP protocol (Universal Measurement and Calibration Protocol) which does pretty much what it sounds like. But it's usually locked down for production.
Fortunately, this was not the case for the BSG :D
I had to hack together my own XCP dump script and it took about 20 minutes to dump the first contiguous memory segment before the BSG reset the session. (CAN is slow ^^")
Now I had exactly 2 MiB worth of some kind of data, maybe/probably the flash contents.

LeoDJ

@LeoDJ@chaos.social · 2 years ago

Time to take a closer look at the dump.
It has a few distinct data sections with empty sections in between.
There are some interesting strings in the dump, but nothing I can immediately make sense of.
But what worries me the most is that it doesn't seem to be just machine code.
At least it's not encrypted, I think, the entropy is too low for that.

LeoDJ

@LeoDJ@chaos.social · 2 years ago

But it looks like some kind of structured data (see attached image, a normal firmware doesn't look like this, ime). Almost looks like many structs after each other, but idk. Maybe some weird #AUTOSAR thingy?
I also threw #Ghidra against the dump with some of the suspected architectures ( #MCP5xxx, #PowerPC, #Tricore), but none returned any plausible looking instructions.

If anyone has an idea how the firmware of a Mercedes / Bosch ECU from ~2016 could be structured, hmu.

3 media

A hexdump starting at 0x20000, displaying some sort of header and _suspiciously_ structured binary data.

Some strings located at around 0x28000, like:
C:\Users\TTI2BP\rtc_sandbox\rbd_eol_stil_fsl_rsg_development_RWS_TTI2BP\rbd\eol\stil\fsl\EcuAbstractionLayer\MemoryHwAbstraction\Fee_Cfg\src\Fee.c
Crc_cpu32 != NULL
((*MgntPtr_pcu32) % FLS_PAGE_SIZE) == 0
(ListType_cu8 == RBC_PDM_IS_LIST_TYPE) || (ListType_cu8 == RBC_PDM_IS_ID_TYPE)
507501D0301
507_501_D_03_01, TTI2BP, 2017/02/16 10:50:32
560_560_D_05_01, leg2lr, 2017/10/17 11:50:55
360_363_D_29_01_P04, leg2lr, 2018/05/29 13:48:33
RSG01_B0001_182002_1742c_D1
2649011400 — Some strings located at around 0x28000, like: C:\Users\TTI2BP\rtc_sandbox\rbd_eol_stil_fsl_rsg_development_RWS_TTI2BP\rbd\eol\stil\fsl\EcuAbstractionLayer\MemoryHwAbstraction\Fee_Cfg\src\Fee.c Crc_cpu32 != NULL ((*MgntPtr_pcu32) % FLS_PAGE_SIZE) == 0 (ListType_cu8 == RBC_PDM_IS_LIST_TYPE) || (ListType_cu8 == RBC_PDM_IS_ID_TYPE) 507501D0301 507_501_D_03_01, TTI2BP, 2017/02/16 10:50:32 560_560_D_05_01, leg2lr, 2017/10/17 11:50:55 360_363_D_29_01_P04, leg2lr, 2018/05/29 13:48:33 RSG01_B0001_182002_1742c_D1 2649011400

The firmware binary loaded into the GIMP raw image importer, set to 1-bit B/W. A wonderful tool to see repeating structures in binary data.
The data looks _very_ structurized. There's no way that that's directly firmware...
Depending on the struct size different patterns emerge. Sometimes it aligns with the selected image width, sometimes not, but it's all very repetitive. — The firmware binary loaded into the GIMP raw image importer, set to 1-bit B/W. A wonderful tool to see repeating structures in binary data. The data looks _very_ structurized. There's no way that that's directly firmware... Depending on the struct size different patterns emerge. Sometimes it aligns with the selected image width, sometimes not, but it's all very repetitive.

LeoDJ

@LeoDJ@chaos.social · 2 years ago

I also found a firmware update file in the depths of the internet that would write to the memory area 0x060000-0x1FFFFF, so it seems I definitely dumped the firmware. But I haven't found a way to extract a .SMR-F file to compare the contents yet.
I'm pretty stumped on how to proceed with the flash dump...