{"id":17,"date":"2011-10-22T09:53:01","date_gmt":"2011-10-22T09:53:01","guid":{"rendered":"http:\/\/arkorobotics.com\/blog\/?p=17"},"modified":"2012-01-18T05:51:31","modified_gmt":"2012-01-18T05:51:31","slug":"iclicker-hacking-part-1","status":"publish","type":"post","link":"http:\/\/arkorobotics.com\/blog\/?p=17","title":{"rendered":"iClicker Hacking – Part 1"},"content":{"rendered":"

Before I start, I’d like to note that this is my first reverse engineering project.<\/p>\n

So the story here starts with me taking a class that required me to purchase one of these iClicker’s (\u00a0http:\/\/www.iclicker.com\/Products\/iclicker\/<\/a>\u00a0), otherwise I wouldn’t get “participation” points in class :\/ So I purchased one and booted it up during lecture to “participate”. It was neat to see some tech in the classroom, but the material wasn’t any more interesting, so I decided to tear this thing apart… I busted out my utilikey and tore it apart mid-lecture.<\/p>\n

\"\"<\/p>\n

At this point the professor noticed all the students were “participating” except me. She then walked up to my desk and noticed the iClicker completely torn apart and asked “What are you doing?” to which I\u00a0responded “Opening this thing up..” and she responded with\u00a0“This is not apart of the lecture, you shouldn’t be doing this in class. This is very important you should be paying attention.” \u00a0I figured it’s time to protect my grades so I said I would clean it up right away, and did so.. (unhappily)<\/p>\n

I snapped a few shots of the tear down before doing so..<\/p>\n

\"\"<\/p>\n

Here we see the Buttons “A” \u00a0“B” \u00a0“C” \u00a0“D” \u00a0“E” \u00a0and “ON\/OFF”.<\/p>\n

\"\"<\/p>\n

Noticed the RF hardware consisted of an XE1203F ( http:\/\/www.semtech.com\/images\/datasheet\/xe1203f.pdf<\/a>\u00a0)\u00a0which does ISM band (iClicker is configured for 900Mhz)<\/p>\n

\"\"<\/p>\n

Discovered the microcontroller is an ATMega8A ( http:\/\/www.atmel.com\/dyn\/resources\/prod_documents\/doc8159.pdf<\/a>\u00a0)\u00a0 and best of all.. the ICSP pads are broken out for you already!! At this point I was hoping that the security bit wasn’t set so I could dump the firmware and EEPROM.<\/p>\n

\"\"<\/p>\n

\"\"<\/p>\n

 <\/p>\n

I later got to my setup at Nullspace Labs ( http:\/\/032.la\/<\/a> ) \u00a0and soldered on a 6pin header for the ICSP line. Then connected my AVR Dragon and attempted to dump the firmware and EEPROM from the ATMega8A with an external power supply connected to the power leads for the battery. As soon as I attempted the read, the iClicker reset itself. So I figured the power management must be doing some funky things, so lets by pass all that and go directly to the ATMega8A’s VCC and GND line. I soldered on some kynar\u00a0wire to pin 4 (vcc) and pin 5 (gnd) and attempted the read again..<\/p>\n

\"\"<\/p>\n

\"\"<\/p>\n

Success!! The security bit was never set! So now that I could communicate with the chip, I decided dumped the firmware and EEPROM. (Reversing in IDA to come in Part 2)<\/p>\n

 <\/p>\n

At this point I realized the hardware ID must be in the EEPROM, so I went exploring looking for “3300B586” which is the hardware ID written on the back of the device:<\/p>\n

\"\"<\/p>\n

\"\"<\/p>\n

I noticed at line 0 column A the sequence “3300B5”, huzah! \u00a0At this point I could just modify this and change the hardware ID of the iClicker!<\/p>\n

 <\/p>\n

\"\"<\/p>\n

Next I decided to listen to the communication between the ATMega8A and XE1203F by sniffing the SPI bus, following the datasheets I soldered up some wire to the SPI lines. Once the wiring was done I used my handy AnnaLogic to sniff the SPI bus.<\/p>\n

\"\"<\/p>\n

AnnaLogic (16-channel logic analyzer) from Nullspace Labs (available for purchase here for $40: \u00a0http:\/\/www.nullspacelabs.com\/catalog\/products.php?5&sid=mkkhjkoj10qo012972ufdfhka3<\/a>\u00a0) Totally easy to use and it fits in an egg!!<\/p>\n

 <\/p>\n

Once I powered up the iClicker (note: it’s not connected to an instructor machine) I began the sniffing and pressed the following sequence of buttons: \u00a0A \u00a0B \u00a0C \u00a0D \u00a0E . I noticed that there was only data on the Slave Input lines, which makes sense since there is no instructor machine to send data back. Between each button I pressed only one byte was changed, and it doesn’t seem to be as\u00a0intuitive\u00a0as ‘A’, ‘B’, ‘C’,’D’,’E’. Instead A = 177 (0xB1) , B = 181 (0xB5), C = 189 (0xBD), D = 190 (0xBE), E = 186 (0xBA).<\/p>\n

\"\"<\/p>\n

Next I need to capture some traffic between my iClicker and the instructor machine to see a full cycle of registering the iClicker to the instructor machine, voting and\u00a0receiving\u00a0confirmation that the vote went through.. I’ll leave that for Part 2.<\/p>\n

Please note that I will NOT be doing this packet capture in the classroom (it’s no place for learning anyway), I’ve decided to purchase an instructor base station to prevent any issues with my school. Plus it gives me control to test and try out things I normally wouldn’t be able to do.<\/p>\n

 <\/p>\n

For the mean time I need the clicker for lectures so I’ve poked a hole into it.. totally looks normal \ud83d\ude42<\/p>\n

\"\"<\/p>\n

 <\/p>\n

Next up.. reverse engineering the firmware in IDA, stay tuned for Part 2:<\/p>\n

\"\"<\/p>\n

 <\/p>\n

So far the only defeat has been spoofing other iClicker hardware ID’s by reprogramming the EEPROM (thankfully iClicker never set any security bits \ud83d\ude42 ) It’s not much yet, but next up is to reverse the firmware and figuring out how the packets are sent, handled and then to create a new firmware with some extra features. A few new features I’ve thought of are listening in to other iClickers, submitting and spoofing as other iClickers, and making a \u00a0general purpose ISM band radio.<\/p>\n

 <\/p>\n

Interested in hardware hacking? \u00a0 Layerone 2012\u00a0http:\/\/www.layerone.org\/<\/a>\u00a0 \ud83d\ude42<\/p>\n","protected":false},"excerpt":{"rendered":"

Before I start, I’d like to note that this is my first reverse engineering project. So the story here starts with me taking a class that required me to purchase one of these iClicker’s (\u00a0http:\/\/www.iclicker.com\/Products\/iclicker\/\u00a0), otherwise I wouldn’t get “participation” points in class :\/ So I purchased one and booted it up during lecture to […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1],"tags":[],"_links":{"self":[{"href":"http:\/\/arkorobotics.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/17"}],"collection":[{"href":"http:\/\/arkorobotics.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/arkorobotics.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/arkorobotics.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/arkorobotics.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=17"}],"version-history":[{"count":13,"href":"http:\/\/arkorobotics.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/17\/revisions"}],"predecessor-version":[{"id":25,"href":"http:\/\/arkorobotics.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/17\/revisions\/25"}],"wp:attachment":[{"href":"http:\/\/arkorobotics.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=17"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/arkorobotics.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=17"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/arkorobotics.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=17"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}