{"id":260,"date":"2024-03-15T20:11:25","date_gmt":"2024-03-15T20:11:25","guid":{"rendered":"https:\/\/www.hooskworks.com\/blog\/?p=260"},"modified":"2024-03-15T21:02:36","modified_gmt":"2024-03-15T21:02:36","slug":"reverse-engineering-the-texecom-rkp-protocol-part-3","status":"publish","type":"post","link":"https:\/\/www.hooskworks.com\/blog\/2024\/03\/reverse-engineering-the-texecom-rkp-protocol-part-3\/","title":{"rendered":"Reverse Engineering the Texecom RKP Protocol (Part 3)"},"content":{"rendered":"\n

Recapping from last time; with the Pi Pico flashed with the picoprobe SWD probe firmware all that’s needed is to power everything up and run the following to connect to the target.<\/p>\n\n\n\n

openocd -f interface\/picoprobe.cfg -f target\/ke0x.cfg -s tcl<\/code><\/p>\n\n\n\n

That should get you some output which looks a lot like the following<\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

When you successfully connect with telenet and issue the following command to openOCD to halt the CPU core and hold it in reset.<\/p>\n\n\n\n

\n
\n

reset init<\/code><\/p>\n<\/div>\n<\/div>\n\n\n\n

Dumping the Firmware<\/h2>\n\n\n\n

Over in the telenet window which is connected to openOCD it time to see what flash is discoverable and try and read it out with the following.<\/p>\n\n\n\n

\n

flash banks<\/code><\/p>\n\n\n\n

flash probe 0<\/code><\/p>\n\n\n\n

flash read_bank 0 output.bin<\/code><\/p>\n\n\n\n

You can skip right to the last command to try and read the firmware out but I was exploring when I first connected and ran the other two to see if the flash layout was what I expected from information in the datasheet of the microcontroller.<\/p>\n<\/div>\n\n\n

\n
\"\"<\/a>
openOCD telnet session output after firmware read out completes<\/figcaption><\/figure>\n<\/div>\n\n\n

If all goes well then you should see output like in the above image from the telnet window and back over in the terminal where openOCD is running something along the lines of the following will be visible.<\/p>\n\n\n

\n
\"\"<\/a>
openOCD terminal window during the flash reading process<\/figcaption><\/figure>\n<\/div>\n\n\n

While everything is hooked up and appears to be working it’s a good plan to do several reads of the flash so they can be compared. If they all match then there’s a good chance you’ve read it out correctly, gotten a good dump, and there aren’t any odd protection mechanisms in play.<\/p>\n\n\n\n

In my case I read out 3 binaries from the microcontroller and got the same 64 kB binary file 3 times which, given the microcontroller being used on has 64 kB of memory in a single bank, suggests they’re all good or all corrupted. For now, I’ll assume they’re all good and carry on!<\/p>\n\n\n

\n
\"\"<\/a>
Hex view of the firmware binary reveals some sensible looking strings<\/figcaption><\/figure>\n<\/div>\n\n\n

A good first to poking at simple firmware packages like you’ll get on this kind of product and for this kind of microcontroller is to run strings against it or, as shown above, open it in a hex editor and see what you can see.<\/p>\n\n\n\n

With things like, “KEYPAD LOCKED!” hiding in there I think we’re on to a winner and we know one more thing too. This is the same firmware as runs on the more expensive remote keypads which have screen on them.<\/p>\n\n\n\n

\n
\"\"<\/a><\/figure>\n\n\n\n
\"\"<\/a><\/figure>\n<\/div>\n\n\n\n

Above are the Texecom remote keypads which are probably the most applicable to this firmware. The one on the left is the one we have, the DCA-0001, and the one on the left is the keypad I believe the firmware also runs on, the DCB-0001.<\/p>\n\n\n\n

This doesn’t impact anything for the time being but it’s all useful intel for things we may see later on in the disassembly.<\/p>\n\n\n\n

Up Next<\/h2>\n\n\n\n

Disassembly of the binary we got and the Ghidra fun begins in Part 4!<\/p>\n","protected":false},"excerpt":{"rendered":"

With the hardware ready it’s time to dump the firmware and see if it looks complete.<\/p>\n","protected":false},"author":1,"featured_media":290,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[21,29],"tags":[43,41,42,38,39,37,40,36],"class_list":["post-260","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-code","category-electronics","tag-openocd","tag-pi-pico","tag-picoprobe","tag-protocol","tag-reverse-engineering","tag-rkp","tag-swd","tag-texecom","col-2"],"_links":{"self":[{"href":"https:\/\/www.hooskworks.com\/blog\/wp-json\/wp\/v2\/posts\/260","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.hooskworks.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hooskworks.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hooskworks.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hooskworks.com\/blog\/wp-json\/wp\/v2\/comments?post=260"}],"version-history":[{"count":5,"href":"https:\/\/www.hooskworks.com\/blog\/wp-json\/wp\/v2\/posts\/260\/revisions"}],"predecessor-version":[{"id":303,"href":"https:\/\/www.hooskworks.com\/blog\/wp-json\/wp\/v2\/posts\/260\/revisions\/303"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.hooskworks.com\/blog\/wp-json\/wp\/v2\/media\/290"}],"wp:attachment":[{"href":"https:\/\/www.hooskworks.com\/blog\/wp-json\/wp\/v2\/media?parent=260"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hooskworks.com\/blog\/wp-json\/wp\/v2\/categories?post=260"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hooskworks.com\/blog\/wp-json\/wp\/v2\/tags?post=260"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}