Electromagnetic Hypersensitivity and You

Wesley Wineberg
B-Sides Vancouver 2015




• PORT NAME: determined by OS
• BAUD RATE: 115,200
• DATA BITS: 8
• STOP BITS: 1


<Command>
<Name>get_device_info</Name>
</Command>


<DeviceInfo>
<DeviceMacId>0xFFFFFFFFFFFFFFFF</DeviceMacId>
<InstallCode>0xFFFFFFFFFFFFFFFF</InstallCode>
<LinkKey>0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF</LinkKey>
<FWVersion>{string}</FWVersion>
…
</DeviceInfo>

<NickName>test</NickName>
<Command>
<Name>set_meter_info</Name>
<NickName>testtesttesttesttesttesttesttesttesttesttesttestt
esttesttesttesttesttest</NickName>
</Command>

<MeterInfo>
<DeviceMacId>0xd8d5b90000001e74</DeviceMacId>
<MeterMacId>0x00078100008dc8e6</MeterMacId>
<Nickname>testtesttesttesttesttesttesttesttesttesttesttes
ttesttesttesttesttesttest</Nickname>
<Account>sttesttesttesttesttest</Account>
<Auth></Auth>
</MeterInfo>

stringBuilder.AppendLine("<command>");
stringBuilder.AppendLine("<name>image_block_dump</name>");
stringBuilder.AppendLine("<offset>0x" + offset.ToString("X8") +
"</offset>");
stringBuilder.AppendLine("<blksize>0x" + blksize.ToString("X2") +
"</blksize>");
stringBuilder.AppendLine("</command>");





 echo -e $(cut -d',' -f4 spi.txt | sed -e 's/0x(..).?/x1/g' | tr -d 'n')

JN5142 and JN5148-J01/Z01 Flash Header
Bytes Word Contents
0x0000 to 0x000F 0 - 3 16-byte Boot Image Record
0x0010 to 0x0017 4 - 5 64-bit MAC address
0x0018 to 0x0027 6 - 9 Encryption Initialisation Vector (ignored if unencrypted)
0x0028 to 0x0029 10 16-bit load address for .text segment in RAM (word aligned)
0x002A to 0x002B 10 16-bit length of .text segment, in 32-bit words
0x002C to 0x002D 11 16-bit load address for .bss segment in RAM (word aligned)
0x002E to 0x002F 11 16-bit length of .bss segment in RAM, in 32-bit words
0x0030 to 0x0033 12 32-bit wake-up entry point (word aligned) – warm start
0x0034 to 0x0037 13 32-bit reset entry point (word aligned) – cold start
0x0038 to (MemA –1) 14 - .text segment
MemA to (MemB-1) .data segment
MemB Overlay segment


get_meter_attributes
set_meter_attributes
erase_halt
secret


 Send Beacon Request, and look for a device that has the 'join'
flag enabled in its beacon.
 After joining the network, wait for the Coordinator to send the
network key encrypted with our link key (derived from the install
code).
 Look for the Key Establishment Cluster using match descriptor.
 Perform Key Exchange.
 If successful, look for the time cluster…

Source Address (8 bytes) +
Frame Counter (4 bytes) +
Security Control (1 byte)


https://bitbucket.org/secdev/scapy-com




Electromagnetic Hypersensitivity and You

Electromagnetic Hypersensitivity and You

Recommended

Recommended

More Related Content

Viewers also liked

Viewers also liked (17)

Similar to Electromagnetic Hypersensitivity and You

Similar to Electromagnetic Hypersensitivity and You (20)

More from Synack

More from Synack (13)

Recently uploaded

Recently uploaded (20)

Electromagnetic Hypersensitivity and You