Brushing Up on Hardware Hacking – Reverse Engineering Electric Toothbrushes

Summary

Brushing Up on Hardware Hacking Part 1 - PiFex Configuration Overview Whether performing a training exercise with a large group or consulting clients with embedded security needs, there is one question that I constantly receive: How do you pick which devices to use when learning hardware reverse engineering? This is a very reasonable question; with so many random embedded devices on the market, picking something easy to learn can be difficult. With this three part "brush-up" series, we want to give our readers examples of devices they can use to learn more about reverse engineering embedded devices. For each of these posts, we will provide links to the software used and (non-affiliate) links to the devices we are tearing down. The first device in our series will be this electric toothbrush. Our goal is to extract the firmware from the device and see if we can also get hardware-level debugging working on the target. Pi-Gen + PiFex For this series, we will use a Raspberry Pi as our hardware hacking multi-tool. While we will use the PiFex board, it will not be required for those following along at home. However, one thing that will need to be used is an SD card image with the appropriate software tools and utilities installed. For this, we'll be using the open-source tools in our PiFex software repo as well as the tool PiGen. PiGen can generate Raspberry Pi images; we will use this to create an SD card image based on the latest Raspbian OS version containing all required software for hardware-level reverse engineering. Building an image with PiGen goes through multiple stages, each responsible for configuring different portions of the resulting image. Our modifications will be performed in stages one, two, and three. In stage one, we modify the config.txt file to enable the various hardware peripherals that we will be using. This includes UART, SPI, I2C, and the DWC2 gadget driver for presenting an Ethernet device over USB. # Modifications to config.txt [all] dtparam=i...