TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Reverse engineering an e-ink display

188 点作者 redfast00超过 2 年前

12 条评论

blutack超过 2 年前
Nice article - is the idea to communicate with the tags with their stock firmware using another CC25x series chip or dev board?<p>Unfortunately, that might be tricky without the private keys in the controller. User manual [0] describes a per site 128 bit AES keys used for the RF comms.<p>Might be easier to just write fresh firmware for them - there&#x27;s some code here [1] for driving the display that could be ported to the CC2510. There&#x27;s SDCC support for at least the CC2511 as used in the Pololu Wixel [2]. It&#x27;s certainly possible that their cryptosystem is broken but I wouldn&#x27;t bet on it.<p>0: <a href="https:&#x2F;&#x2F;fcc.report&#x2F;FCC-ID&#x2F;2ACQM-EDG2-0590-A&#x2F;4393106" rel="nofollow">https:&#x2F;&#x2F;fcc.report&#x2F;FCC-ID&#x2F;2ACQM-EDG2-0590-A&#x2F;4393106</a><p>1: <a href="https:&#x2F;&#x2F;github.com&#x2F;atc1441&#x2F;E-Paper_Pricetags&#x2F;tree&#x2F;main&#x2F;GxEPD2_modded">https:&#x2F;&#x2F;github.com&#x2F;atc1441&#x2F;E-Paper_Pricetags&#x2F;tree&#x2F;main&#x2F;GxEPD...</a><p>2: <a href="https:&#x2F;&#x2F;www.pololu.com&#x2F;product&#x2F;1336&#x2F;resources" rel="nofollow">https:&#x2F;&#x2F;www.pololu.com&#x2F;product&#x2F;1336&#x2F;resources</a>
评论 #34741648 未加载
focusedone超过 2 年前
I&#x27;m so happy there are people out in the world able to reverse engineer things like this and share the results publicly. Freakin&#x27; cool.
评论 #34743750 未加载
dclowd9901超过 2 年前
&gt; The biggest barrier to hacking is often the fear that you’ll break something while poking around. But you have to break eggs to make an omelet; likewise, you have to be willing to sacrifice devices to hack a system. Fortunately, acquiring multiple copies of a mass-produced piece of hardware is easy. I often do a bit of dumpster diving or check classified advertisements to get sample units for research purposes. I generally try to start with three copies: one to tear apart and never put back together, one to probe, and one to keep relatively pristine.<p>I love learning this kind of stuff through this site. In the world of reverse engineering or hacking stuff together, it feels like such a fumbly exercise that there just isn’t any discipline to it, but experts definitely learned some tricks and learning from them is such a treat. I’ll have to download that book and give it a read sometime soon.
评论 #34741377 未加载
dave78超过 2 年前
I wonder if there are larger implications to reverse-engineering this. When I worked in retail in high school, I was told repeatedly that if a price was marked on a shelf, then there are laws that require the store to sell that item for that marked price. (IANAL so I don&#x27;t know the nuances there, but it makes sense). If it becomes easy to change these displays with a new price wirelessly, that could be a really nasty problem for any stores using these displays.<p>Hopefully for the store&#x27;s sake, there&#x27;d be some sort of public&#x2F;private key system so that only the holder of the private key can distribute price changes wirelessly. I wouldn&#x27;t bet money on that though.<p>(edit) - I see someone else posted the manual and that there&#x27;s a per-site AES key. That&#x27;s a good sign I guess.
评论 #34741669 未加载
评论 #34741857 未加载
irsagent超过 2 年前
Very well written article. I have been looking for some inspiration to get into hardware hacking and I think this article did it for me.<p>I find it interesting that in most writeups voltage injection is a popular appraoch to turning on debug mode. The aricle makes mention to other class of fault injection attack such as clock glitching or electromagnetic fault injection, but are there other approaches that I could look into, just out of curiousity?
评论 #34744336 未加载
layer8超过 2 年前
It still somehow breaks my intuition that it’s cost-effective to have thousands of these deployed in each supermarket. I mean, I do understand it rationally, but it’s still weird.
评论 #34741394 未加载
评论 #34741905 未加载
评论 #34742900 未加载
评论 #34748241 未加载
adversaryIdiot超过 2 年前
God I wish this could be me so bad. But they do some really crazy stuff to hack this and I just don&#x27;t have the time or mental capacity to learn.
mk_stjames超过 2 年前
I wonder what the motivation is the attempt to use the stock firmware and reverse engineer whatever communication and potential key signing the device has from the factory, versus just wiping the flash &#x2F; desoldering and replacing with completely new firmware from scratch.<p>That would require completely tracing the PCB out to understand the display drive from the uC and other pin assignments, but... I find that much easier. And then the end result is the potential for a completely understood hardware &amp; software configuration.
评论 #34746598 未加载
GianFabien超过 2 年前
I might be missing something. I&#x27;ve seen other reverse engineering projects where they simply unsoldered the flash memory and read out the contents. Wasn&#x27;t that an option?
评论 #34746626 未加载
Mraedis超过 2 年前
I wonder how popular this tag must be&#x2F;have been to be able to find someone that had already dissolved&#x2F;sandpapered it? Can&#x27;t wait for the follow-up on this, turn that e-waste into something usable!
评论 #34740731 未加载
评论 #34745939 未加载
评论 #34741984 未加载
MayeulC超过 2 年前
How about glitching a write instruction to overwrite the copy protection register instead?
评论 #34746096 未加载
评论 #34745632 未加载
60fps超过 2 年前
very well written article, thanks for sharing your findings! gg!