# Yifan Lu Random stuff I'm making and thinking This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Unbricking SHIELD TV (2015) with a Bootrom Exploit DevFeed: [Unbricking SHIELD TV (2015) with a Bootrom Exploit]() Original publisher: [Read original article]() Author: yifanlu Published: 2022-06-17T07:00:00Z Content type: article Language: en Sources: [Yifan Lu]() Topics: [Reverse Engineering](), [Raspberry Pi](), [configuration](), [boot](), [Nvidia](), [Linux]() Tags: [boot](), [bootrom](), [configuration](), [embedded](), [exploit](), [linux](), [nvidia](), [raspberry-pi](), [rcm](), [reverse-engineering](), [t210](), [tegra]() ### AI overview The article documents recovering a 2015 NVIDIA SHIELD TV after flashing an outdated device tree blob left it unable to boot. It examines serial-console diagnostics and the Tegra boot ROM's APX emergency recovery mode, including its use of NVIDIA's RCM protocol. ### Source excerpt Last year, a friend gave me his SHIELD TV when he moved. He worked at NVIDIA and got it for free and had used it only a handful of times before it traveled from his closet to my own. I had forgotten about it until I had a need for a Raspberry Pi and discovered that they were all still sold out. Wouldn't the SHIELD TV make a great RPI replacement? It has been out for almost a decade now and surely people have gotten Linux working on it. After following a guide from 2015, I quickly bricked the device trying to flash an outdated DTB file. It turns out that a bad DTB brick was quite common in the community and unfortunately the only proposed solution of "return it to Best Buy" was not an option for me. Even though I have never cared about this device, I was still ashamed at my negligence and felt guilty about creating more e-waste. Thus began my journey to recover the device. ## Extracting Boot Code from a Prototype PlayStation Vita Development Kit DevFeed: [Extracting Boot Code from a Prototype PlayStation Vita Development Kit]() Original publisher: [Read original article]() Author: yifanlu Published: 2019-08-16T07:00:00Z Content type: article Language: en Sources: [Yifan Lu]() Topics: [Code](), [Hacking](), [Hardware](), [boot](), [Embedded Software Dev](), [Kernel]() Tags: [boot](), [bootrom](), [code](), [console](), [develop](), [development-kit](), [experiment](), [firmware](), [glitching](), [hacking](), [hardware](), [history](), [kernel](), [prototype](), [vita]() ### AI overview The author describes attempting to extract boot code from a rare prototype PlayStation Vita development kit, using hardware-hacking techniques and documenting the work as part of preserving the system's historical data. ### Source excerpt A few months ago, a contact reached out to me with an irresistible offer. I would be given the opportunity to experiment with an insanely rare, prototype development kit PlayStation Vita. The only ask from my source is that I somehow dump the boot code. I've spent the last seven years hacking every last bit of the Vita from exploiting the kernel to extracting hardware keys with AES fault injections. In that long journey, I've gotten intimate with every model and revision of the Vita so it seems inevitable that I would find myself with the very first prototype. The DEM-3000L is actually more rare than the DEM-3000H that recently made headlines having been sold for $20,000. Although I cannot confirm this independently, my source claims that the DEM-3000H units were distributed to early game developers while the DEM-3000L was used internally at Sony to develop the system firmware. The history of this particular DEM-3000L was that two of these were originally found side by side at a Chinese landfill. They had extensive water damage (I was told they were "at the bottom of a lake") and was carefully repaired. One of the two (the one with the broken display) eventually made it to me. ## Attacking Hardware AES with DFA DevFeed: [Attacking Hardware AES with DFA]() Original publisher: [Read original article]() Author: yifanlu Published: 2019-02-22T08:00:00Z Content type: article Language: en Sources: [Yifan Lu]() Topics: [Hardware](), [Algorithm](), [Code]() Tags: [algorithm](), [bigmac](), [blog-post](), [code](), [dfa](), [dpa](), [f00d](), [glitching](), [hardware](), [paper](), [technical](), [vita]() ### AI overview A companion blog post explains an attempt to extract hardware keys from the PlayStation Vita using differential fault analysis against hardware AES. It introduces glitch-based faulty encryptions, reviews existing AES DFA implementations, and describes practical tradeoffs in adapting phoenixAES. ### Source excerpt For the past couple of months, I have been trying to extract the hardware keys from the PlayStation Vita. I wrote a paper describing the whole process with all the technical details, but I thought I would also write a more casual blog post about it as well. Consider this a companion piece to the paper where I will expand more on the process and the dead ends than just present the results. In place of technical accuracy, I will attempt to provide more intuitive explanations and give background information omitted in the paper. ## The First F00D Exploit DevFeed: [The First F00D Exploit]() Original publisher: [Read original article]() Author: yifanlu Published: 2019-01-11T08:00:00Z Content type: article Language: en Sources: [Yifan Lu]() Topics: [Exploit](), [Hacking](), [vulnerability](), [Security](), [Encryption](), [Hardware](), [cpu]() Tags: [article](), [bigmac](), [boot](), [encryption](), [exploit](), [f00d](), [hacking](), [hardware](), [heap-overflow](), [henkaku](), [processor](), [security](), [vita](), [vulnerability](), [writeup]() ### AI overview This technical article documents work on the first F00D exploit for the PlayStation Vita, including a memory-corruption vulnerability in a service and the role of F00D's private memory and cryptographic hardware accelerator. ### Source excerpt This article was originally written 2019-01-11 and published on 2019-07-29 for the third anniversary of HENkaku, the first Vita jailbreak. It documents the work we did in early 2017, just days after the seminal "octopus" exploit. Although the work is dated and does not open any new doors, the technical contents might be interesting for a particular audience. The original intention was to post this after someone else independently discovers the same vulnerability. There were many overt hints on the HENkaku wiki that the 0x50002 service was buggy but I underestimated the interest (or skills) that people would have in hacking an exotic processor that ultimately does nothing for people who just want to run homebrews or play pirated games. ## Injecting Software Vulnerabilities with Voltage Glitching DevFeed: [Injecting Software Vulnerabilities with Voltage Glitching]() Original publisher: [Read original article]() Author: yifanlu Published: 2019-01-10T08:00:00Z Content type: article Language: en Sources: [Yifan Lu]() Topics: [Vulnerabilities](), [Software]() Tags: [ee](), [glitching](), [math](), [model](), [paper](), [reasoning](), [software](), [technical](), [vita](), [vulnerabilities]() ### AI overview A preprint paper examines glitching the PS Vita to inject software vulnerabilities and presents a simple low-level model for reasoning about voltage glitches. ### Source excerpt I am not a fan of New Year's resolutions, but I do want to do more technical writing this year. So here is a preprint of a paper I wrote on glitching the PS Vita as well as a simple model for reasoning about voltage glitches at a low level. ## Vita HDMI Mod (Attempt) DevFeed: [Vita HDMI Mod (Attempt)]() Original publisher: [Read original article]() Author: yifanlu Published: 2017-12-31T08:00:00Z Content type: article Language: en Sources: [Yifan Lu]() Topics: [Hardware](), [hdmi](), [SOC](), [Development]() Tags: [components](), [connectivity](), [development](), [hacking](), [hardware](), [hdmi](), [i2c](), [lcd](), [mipi](), [oscilloscope](), [pcb](), [soc](), [vita]() ### AI overview The article documents an unsuccessful attempt to develop an HDMI mod for the PlayStation Vita. It explains the Vita's MIPI DSI outputs, the constraints of its hardware layout, and the proposed use of the ADV7533 to convert the display signal to HDMI. ### Source excerpt For the last couple of months, I've been developing an HDMI mod for the Vita on my free time. I thought it would be a fun project to practice my hardware design skills even though the end product would not be too useful (the VitaTV already exists). Unfortunately, this project did not end in success but I want to write about it anyways so you can see what I've been doing with some of the leftover money from my adapter project. ## Foobar, Blossoms, and Isomorphism DevFeed: [Foobar, Blossoms, and Isomorphism]() Original publisher: [Read original article]() Author: yifanlu Published: 2017-09-13T07:00:00Z Content type: tutorial Language: en Sources: [Yifan Lu]() Topics: [Programming](), [Code](), [Google]() Tags: [algorithm](), [computer-science](), [foobar](), [google](), [guards](), [latex](), [math](), [number-theory](), [programming](), [technical]() ### AI overview A detailed solution to Google Foobar's "Distract the Guards" problem. The article models when two guards enter an infinite loop and explains how maximum matching can pair the greatest possible number of guards into such loops. ### Source excerpt A friend recently invited me to participate in Foobar, Google's recruiting tool that lets you solve interesting (and sometimes not-so-interesting) programming problems. This particular problem, titled "Distract the Guards" was very fun to solve but I found no good write-ups about it online! Solutions exist but it is rather hard to understand how the author came upon the solution. I thought I might take a shot and go into detail into how I approached it-as well as give proofs of correctness as needed. ## psvsd: Custom Vita microSD card adapter DevFeed: [psvsd: Custom Vita microSD card adapter]() Original publisher: [Read original article]() Author: yifanlu Published: 2017-08-22T07:00:00Z Content type: article Language: en Sources: [Yifan Lu]() Topics: [Reverse Engineering](), [Hardware](), [USB](), [pcie](), [Kernel](), [boot]() Tags: [debug](), [development](), [enso](), [hacking](), [hardware](), [henkaku](), [kernel](), [pcb](), [pcie](), [reverse-engineering](), [usb](), [vita]() ### AI overview This article describes reverse engineering work on the PlayStation Vita's hardware and software, including identifying UART debug connections and examining USB capabilities across Vita models. It discusses the 3G modem's custom mini-PCIe connector and related board connections. ### Source excerpt One thing I love about Vita hacking is the depth of it. After investing so much time reverse engineering the software and hardware, you think you would run out of things to hack. Each loose end leads to another month long project. This all started in the development of HENkaku Ensō. We wanted an easy way to print debug statements early in boot. UART was a good candidate because the device initialization is very simple and the protocol is standard. The Vita SoC (likely called Kermit internally as we'll see later on) has seven UART ports. However, it is unlikely they are all hooked up on a retail console. After digging through the kernel code, I found that bbmc.skprx, the 3G modem driver contain references to UART. After a trusty FCC search, it turns out that the Vita's 3G modem uses a mini-PCIe connector but with a custom pin layout and a custom form factor. The datasheet gives some useful description for each pin, and UART_KERMIT seemed like the most likely candidate (there's also UART_SYSCON which is connected to the SCEI chip on the bottom of the board, which serves as a system controller and a UART_EXT which is not hooked up on the Vita side). So finding a debug output port was a success, but with the datasheet in front of me, the USB port caught my attention. Wouldn't it be neat to put in a custom USB device? ## HENkaku Ensō bootloader hack for Vita DevFeed: [HENkaku Ensō bootloader hack for Vita]() Original publisher: [Read original article]() Author: yifanlu Published: 2017-07-31T07:00:00Z Content type: article Language: en Sources: [Yifan Lu]() Topics: [Reverse Engineering](), [Exploit](), [Vulnerabilities](), [boot](), [Security](), [Kernel]() Tags: [bootloader](), [cfw](), [enso](), [exploit](), [hack](), [hacking](), [hardware](), [henkaku](), [kernel](), [reverse-engineering](), [security](), [vita]() ### AI overview This article describes a bootloader buffer-overflow vulnerability in the PlayStation Vita. The exploit can overwrite a function pointer, patch the kernel before it boots, and is reported as affecting firmware versions 3.61 through 3.65, while installation requires kernel privileges and modification of the internal storage's MBR. ### Source excerpt When we (molecule) were reverse engineering the Vita's firmware years ago, one of the first vulnerabilities we found was in the bootloader. It was a particularly attractive vulnerability because it was early in boot (before ASLR and some other security features are properly initialized) and because it allowed patching the kernel before it booted (which expands what can be done with hacks). Unfortunately, the exploit required writing to the MBR of the internal storage, which requires kernel privileges. That means we would have to exploit the kernel (à la HENkaku) in order to install the exploit. (Before you ask, no it is not possible to install with a hardware mod because each Vita encrypts its NAND with a unique key. Also, there are no testpoints for the NAND, so flashing it is notoriously difficult... not as simple as the 3DS.) So, we mostly forgot about this vulnerability until quite recently when we finally all had some free time and decided to exploit it. ## Reverse-engineering a discarded cable modem to modify its MAC address DevFeed: [Reverse-engineering a discarded cable modem to modify its MAC address]() Original publisher: [Read original article]() Author: yifanlu Published: 2017-04-02T07:00:00Z Content type: article Language: en Sources: [Yifan Lu]() Topics: [Hardware](), [Reverse Engineering](), [Raspberry Pi](), [Shell]() Tags: [bpi](), [cryptography](), [des](), [devices](), [docsis](), [firmware](), [hacking](), [hardware](), [mips](), [partition](), [raspberry-pi](), [reverse-engineering](), [root](), [spi](), [wifi]() ### AI overview The author describes reverse-engineering a discarded cable modem that was still tied to another customer account. They accessed its UART root shell using a Raspberry Pi, dumped the flash memory, located the MAC address in an NVRAM partition, replaced it, and found that the modem still refused to establish a connection. The supplied text ends before the investigation is completed. ### Source excerpt Recently, I stumbled upon an old cable modem sitting next to the dumpster. An neighbor just moved out and they threw away boxes of old junk. I was excited because the modem is much better than the one I currently use and has fancy features like built in 5GHz WiFi and DOCSIS 3.0 support. When I called my Internet service provider to activate it though, they told me that the modem was tied to another account likely because the neighbors did not deactivate the device before throwing it away. The technician doesn't have access to their account so I would have to either wait for it to be inactive or somehow find them and somehow convince them to help me set up the modem they threw away.