The signal-to-noise ratio of your channel is off the charts!  Congrats - keep it up.


Great video! Would love to see some more embedded FW reverse engineering like this :D


As a mostly embedded programmer this is great, much easier to follow when there's no complicated OS to worry about.

@BRUHItsABunny

-Fast

-plenty of libraries

-Has the best syntax ever created by mankind

@Tunahan Karatay this was an insightful answer, thank you

@BRUHItsABunny What's the alternative, Javascript? Embedded means closer to bare metal, and the closest you can get to bare metal is by using C and Assembly. There are so many cases in which you just need raw memory access. Rust is probably going to replace it in the future, because it is really well structured. This is related to the second reason why embedded programmers use C. It's so efficient and straightforward. In applications that run on a normal PC, it makes sense to use thinks like Go, Python, etc. But in embedded, you need perfectly deterministic software. C is a perfectly predictable language, there is no chance of some random delay caused by the garbage collector etc. Rust has the same design philosophy, but it doesn't allow most memory bugs.

Embedded applications can be with an OS. Many STM32 (and other) devices uses FreeRTOS or another real-time operation system.

@Gianluca Recchia So you use the great interfacing capability of Rust and use C. That is because of simplicity. Sometimes this forces you nearer to the Hardware and away from the abstraction. BTW I don't say you have to choose C. Pick the appropriate tool or one that you are familiar with the most.
For example, designing a very simple switch application with a resulting binary of 100 bytes using a Rust tool-chain of several Gb may be overkill. Or you are bound to industry standards required by your client. Maybe there is no need for the rat tail of a dependency system. Or you need just some "ldr r0, [pc, #208]" here and some "movs r1, #1" there, because it is simpler to "((volatile unsigned short *)(PORTBASE + 208)) = 1;". For Rust see https://doc.rust-lang.org/core/intrinsics/ and core::ptr::write_volatile alike.
Another case can be if a mature system is needed which you can rely on and here, C is the quasi standard in the industry. Also good luck finding a 8051 toolchain for Rust or for similar exotic/legacy(I love C= :-)) processors.

But no programming language or tool-chain frees you from knowing your hardware, e.g. reading data-sheets, knowing specs. etc. Usually AFTER you know the basics and theory behind an area you can begin with abstraction. The only time this works the other way around is if you are curious about something and start to learn the stuff behind.

TLDR; Use what you are familiar with and have fun:)
P.S: C 2.0 ? You forgot C++ and D as heritage. Then Rust is C 4.0 :)

@Jedzia Dex I've been into Rust only for a few weeks but I'd be interest to know why, in your opinion, C gives you more control over the hardware compared to Rust. They both seems on-par as to the level of abstraction they work at. Rust with no-std (rust without the standard library that is) becomes extremely low-level, while still having all the safety guarantees it normally provides. Rust is going to become C 2.0, basically. The only reason you wouldn't use Rust for new code is because you have so much legacy code to worry about; and even then, Rust seamlessly talks to C code, with no performance loss whatsoever.

@Adri Depends on the project you work on. Maybe for hobby in this state of Rust and this kind of MCU. If you're doing a consumer product you will have your setup with your toolchain and exactly defined framework conditions about your libraries, years of knowledge about the hardware and hopefully deep insight. If you don't get memory safety by yourself with C, Rust won't be a magic bullet one might expect. Features such as package management that e.g. cargo provides is rather counterproductive and more a pollution. Don't get me wrong, this is great for other cases ... let's say on a MIPS based approach with a Linux-Kernel, where you use OpenSSL, Server-implementations, etc.
But on such small platforms you want to have (and can have) full hardware control.
The interested one can have a sneak peak at https://github.com/rust-embedded/awesome-embedded-rust

@Asaf Cohen Id say rust is another great rising option too right now.

@BRUHItsABunny c is basically the only option if you want to do effective embedded programming

As a beginner in coding this really helps me understand what I’m learning so much better.

@Asaf Cohen i have no idea and 0 experience in C nor embedded programming however I am interested as to why C is irreplaceable when it comes to embedded programming

also an embedded programmer here just wanted to say c is unreplaceable


great editing its cool that you dont pass on the technical aspects and not just the theoretical concepts


Thank you sir. As a beginner in reverse engineering that's starting with a bare metal firmware, this video is very helpful. Please do more


Coming from the Bare-Metal world, I often wonder how OSes actually do their thing on microcontrollers, and how to develop for them.


I don't have this device nor do RE for a living. But damn this is getting me close to trying this out. Always found integrated boards and chipsets fascinating

16 Bucks, Amazon or else where. Search for "NUCLEO stm32f446re". Use  Ghidra Ninja's links in the description to ST-Microelectronics to get an overview for this bugger or discover many more different types. These are great to begin with. What are you waiting for? :))


One thing I'd suggest with regards to memory mapping is to clear the write flag in the flash regions. That way Ghidra automatically dereferences constants and show strings as quoted strings rather than a pointer to a string. Do keep in mind it also removes what it considers to be extraneous reads and writes and unreachable code based on constants, so if there's some configurable options in the firmware, it may remove code from the decompilation for other options that it sees as unreachable.


These videos are an absolute goldmine. Incredible work


Outstanding!  Thanks for continuing to share your dedicated work


I am really impressed and grateful. This was the most useful jump start I've gotten.


I've legit been looking for so long for content creators who just explain such things in detail without all the bs

@stacksmashing though it did take off very fast at the middle ahaha


Excellent thanks for writing the SVD loader script. This video popped into my feed and ironically I am just waiting on some details of cortex M3 project which may require some reversing (although hopefully not from a work POV).


Very good information. This is the exact microcontroller we used in our embedded systems courses in university!


Would just like to say, your videos inspired me to have a go at reverse engineering something, so I grabbed a Cisco 2501 router off ebay (because its got a Motorola 68030 in it), and used Ghidra to explore the boot ROMs (was amazed that it supported the m68k architecture!), figured out the memory map, and managed to get FreeRTOS running on it after creating a m68k port for it. :-)

Love your channel!

@stacksmashing Ive put notes of what I have found so far up on github, including my FreeRTOS port. I dont know if I can post links here (sometimes works, sometimes doesnt), but you can find it by searching users for my name as one word (the one that doesnt end in sn).

Theres more I would like to find out about it, including a couple more registers within two proprietary chips, but its a monumental task!

That’s awesome to hear! And sounds like a super interesting project - you should do a write up! :)


Very impressive and educational, thanks!


Hi thanks for this awesome video, do you know any other device on which we can improve our knowledges, like a device where you need to extract the firmware with jtag ?<br>Really enjoy your videos :D

Hi thanks for this awesome video, do you know any other device on which we can improve our knowledges, like a device where you need to extract the firmware with jtag ?
Really enjoy your videos :D


Nice explanation, I'm surprised at how fast you were able to go through that in Ghidra, it still takes me quite a while to create names and clean up decompiled output. Seems like a good goal.


This is the best tutorial of reverse engineering embedded systems with ghidra I've seen so far. Some days ago I wanted to RE an STM  board but didn't know how to proceed. Could you please do something like this with the nRF51 or nRF52 processors?

@Kotesu   Yeah I somewhat got it to work and managed to seperate the parts of the firmware (softdevice, app, etc.), but ghidra still has some control flow detection issues on arm, which makes everything complicated. It really is a PITA

Unfortunately, most Nordic nRF-series micros are built on top of their Softdevice middleware,  which, while technically not an OS, is pretty close to being one. It's also notoriously bad and can obfuscate alot of behaviours. The whole experience can be summarized as one colleague put it: "you don't own the chip, you rent it".  I think it would be a huge challenge to reverse-engineer. I've done 15 years of bare metal development and that chip was one of the biggest pain-in-the-ass I ever experienced.


Love this channel - thanks for you all your vids. Bare metal/Embedded/IOT/Soc adventures are like "crack" for coders - I need help :P


Now I ask myself why I didn't know this channel before. Great work!


Nice Video, thanks:)
Be careful with the 5V. Not all pins are tolerant. See "FT" specification in data-sheet, Table 9 for this MCU (Depends on the series). To avoid this: There is 3.3V right next to the 5V supply pin on the NUCLEO. Up to 112 5 V-tolerant I/Os on max 114 I/O for the LQFP144 part. So the chances are good to not release the magic smoke:)
Yours is a LQFP64, so better look that up folks. At all, don't rely on chance. It's a 3.3V part and best practice is to treat it like one. While experimenting, only use the 5V-tolerance functionality if absolutely necessary. This protects against nasty surprises

If you watch closely you'll see that I used the pin NEXT to the 5V pin, which is 3.3V 😉


Thank you mate your videos are the greatest in this field.


IOT reversing from Ghidra Ninja? I absolutely love it!! 😍


Great Channel man.  You explain so well.<br>Good Job.

Great Channel man.  You explain so well.
Good Job.


I swear. You give better lectures than all my CA teachers together!


Thanks for the video! Curious, but how did you get the baremetal firmware (example.bin)?


I just started to reverse some code for STM32F2 and you just make my life easier, ty <3


Excellent upload timing, my STM32 blue pill arrived but a couple days ago. Keep up the good work!


top quality. i was wondering about custom ARM ASIC without datasheet. how to guess base adress ? Now days they are everywhere they enable to reduce PCB size & cost  & make reverse-engenring harder.  ARM ASIC includes custom IP modules inside the SOC.


i tried rev engg with atmega2560 last year, ghidra has support for it, I just had to import the bin/hex file, the thing is i already knew every reg, therefore it was easier for me to rev engg the source code when I look at ghidra's conversion


interesting topic and really well made video!


I watched a video and subscribed right away! Amazing content 😊


The fact that STM calls their mode register MODER in their docs which loosely translates to mold in german, always cracks me up.


I've always thought that a computer was defined by both hardware AND an operating system. For a bare metal, does the application assume the role of operating system, how does the hardware "communicate" with the app ? Thanks

The app has to do everything an OS does, just that you don't write code for what you don't need. The app can do everything an os does, if you write it, but most bare metal code tends to be simpler.


as a beginner in RE, where should I start if I want to learn? I have a cyber security background, just not an RE background


Which DevOps Engineers also thought this would be a bare metal tutorial for Kubernetes 😆


Omg this video brings up memories, I used ARM to build a robot. And oh boy, it's mind consuming to read the datasheet -.-


omg man.. please do tutorial series and teach us how to use Ghidra :)


Thanks! Any hints from you how to reverse engineer BOSH BHI160 sensor firmware? https://www.bosch-sensortec.com/products/smart-sensors/bhi160-firmware/ I believe they may use Zephyr. In any case `binwalk` kept silent, Ghidra doesn't help much seems...


And how do you get the binary from a flashed device?


Pls show how to include SVD scripts in ghidra environment I tried hard but  can't find SVD scripts in script manager pls help


is it possible to flash a customized board firmware?


Please keep sharing RE videos<br>Ill be back for this stuff..

Please keep sharing RE videos
Ill be back for this stuff..


Nice, I can't wait till chips are purpose built for this accessibility to clock cycles - C'mon people WORK ON YOUR AI BABY MODELS!


Can someone give me a list of prior knowledge do i need to do these things, roughly


Brilliant I have a challenge I know some brilliant mind like you Will solve it I need help with a Korean nintendo wii Locked on error 003 after update there is way to fix it but it's a painful and I can't find a modchip if there any way through software please and a lot of thanks to you for your time and work


Much more comfortable watching this at 0.75 speed lol


how did you get the display out that prints the crackme messages? the cable connected is a usb cable to power the microcontroller, right?

It's a serial terminal, the USB cable provides power and also a virtual serial port (and also access to the integrated ST-Link programmer)


I'm having trouble finding the link to download example.bin. Can anyone help me out?


Tip: leave the address on the end of an unknown name. Eg usart_fn08000752. Then you don't have to worry about having a dozen different functions named usart_fn3 scattered around.


The main reason why I clicked on this video was that I was hoping to learn how to export binary from mcu :(


Would a reasonable way to be able to tell the endianness just be trial and error?


Please on your previous video on creating back door to a camera. I am having issue using the mkimage. It is not working for me. Is it not part of tools in Kali? Do I need to install it. I am not getting direct link on how to go about it. Can you help please?

@resync cyberwatch. Thank you<br> I will search for it and try it. Many thanks

@resync cyberwatch. Thank you
 I will search for it and try it. Many thanks

Just use firmware mod toolkit. It's easier that way. Btw. @GhidraNinja, you might wanna try firmware-mod-toolkit too. It's got sources for all versions of squash fs (even industrial versions).

Edit: I mean squash fs tools.

I don't know if it's part of Kali, but on Ubuntu it's part of the "u-boot-tools" package


I can't wait for next wannacry inverse engineering


I'm sorry but how did you figure out the SRAM lenght to that you put in the memory map? The SRAM blocks on the MCU I'm trying go from 0x20000000 to 0x40000000, also at the start of the Memory section in the datasheet says the chip has 256 kB RAM, so do I just put 0x40000 or could that be a different length since there are separate RAM and SRAM blocks and I see you are putting the SRAM's starting address


So... Yikes... Looks like I'm too 👂ly here.


Not sure where to find the ghidra python module ?  Python reports that I am missing this.  Any idea where to find that ?

Thank you !  I didn't understand how it all went together at first.  Found Ghidra at  ghidra-sre.org  and also downloaded  the SDK from  aws.amazon.com/corretto/  and things are up and running !  The biggie for me was understanding what ghidra itself was.  I am using this same STM32F446 except for it being 100 pin so may be helpful to me !  Also fun to play with the other processors.  Now if there is a .elf import too, I might be able to include source code comments ?  Not sure if it does that or not

You need to run the script from within Ghidra, then it should be fine


Im subscribed to this channel cz the dragon looks cool


I didn't find decompiler for stm32f103c4 elf file to c code error

When I try to do analysis and c code is not generated 😭I tryed on virtual box with Ubuntu 20 now I got c code generated 😀👍✌👌

@stacksmashing I used elf file of microcontroller STM 32f103c4 and I installed ghidra on Ubuntu 18 running of Jetson nano Nvidia board (GPU micro pc) and iam getting error as "decompiler missing__could not find decompiler excutable decompile"


Please, do a similar video but now with the most popular MCU: atmega328 (Arduino UNO)

LiveOverflow did a couple on them: https://www.youtube.com/watch?v=D0VKuZuuvW8


I'm sorry - I cannot get past you referring to 0x20000000 as hex two thousand etc. A hard pass on what could potentially have been an interesting video.


Pls reply fast because I have a project to complete

Add folder script folder to script directories in script manager but no effect and don't show in script list

You have to add the script folder to the paths Ghidra searches for scripts in


Add script folder to script directories in script manager but dont show scripts in script list

Have you clicked the refresh button? Otherwise something else is wrong, the SVD-Loader.py script will get detected by Ghidra once it's in the search path.


Sorry, but way too much base and I can hardy make out what you are saying.