The Car Hackers Handbook. A Guide for the Penetration Tester. Craig Smith. San Francisco. THE CAR HACKERS HANDBOOK. Copyright 2. 01. Craig Smith. All rights reserved. No part of this work may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or by any information storage or retrieval system, without the prior written permission of the copyright owner and the publisher. ISBN 1. 0 1 5. ISBN 1. Publisher William Pollock. Production Editor Laurel Chun. Cover Illustration Garry Booth. Interior Design Octopod Studios. Developmental Editors Liz Chadwick and William Pollock. Technical Reviewer Eric Evenchick. THE CAR HACKERS HANDBOOK. A Guide for the Penetration Tester. Craig Smith. Interfacing a new microchip can be a hassle. Breadboarding a circuit, writing code, hauling out the programmer, or maybe even prototyping a PCB. Software and other tools. Configuring is based on webinterface on port 80 of the devices IP Older nonSFN enabled firmwares web interfaces sample is here. Hi, Id be happy to save my bootblock but wont you be wanting a copy of the 003 bootblock The one that I have up and running at the moment is the one pictured. Homebrew is a term frequently applied to video games or other software produced by consumers to target proprietary hardware platforms usually with hardware. Spi Flashrom Programmer' title='Spi Flashrom Programmer' />This is an online lecture in Computer Hardware Servicing, prepared by Mr. George P. Lumayag, ICT Coordinator. These Skills Learning Competencies are patterned from. Copyeditor Julianne Jigour. Compositor Laurel Chun. Proofreader James Fraleigh. Indexer BIM Indexing Proofreading Services. The following code and images are reproduced with permission Figures 5 3 and 5 7 Jan Niklas Meier Figures 6 1. Matt Wallace Figures 8 6, 8 7, 8 8, and 8 2. Spi Flashrom Programmer' title='Spi Flashrom Programmer' />Nsledovala vroba programtoru. K pipojen SPI zazen k PC vak sta obyejn paraleln port, 5 drt, pr odpor a konektory. New. AE Technology Inc. Brute forcing keypad entry code on pages 2. Peter Boothe Figures 1. A 6 Jared Gould and Paul Brunckhorst Figures A 1 and A 2 SECONS Ltd., http www. Figure A 4 Collin Kidder and EVTV Motor Werks. For information on distribution, translations, or bulk sales, please contact No Starch Press, Inc. No Starch Press, Inc. Street, San Francisco, CA 9. Library of Congress Cataloging in Publication Data. Names Smith, Craig Reverse engineer, author. Title The car hackers handbook a guide for the penetration tester by Craig Smith. Description San Francisco No Starch Press, 2. Includes index. Identifiers LCCN 2. ISBN 9. 78. 15. 93. ISBN 1. 59. 32. 77. Subjects LCSH Automotive computers Security measures Handbooks, manuals,     etc. Automobiles Performance Handbooks, manuals, etc. Automobiles Customizing Handbooks, manuals, etc. Penetration testing     Computer security Handbooks, manuals, etc. Automobiles Vandalism Prevention Handbooks, manuals, etc. Classification LCC TL2. S6. 5 2. 01. 6 DDC 6. LC record available at http lccn. No Starch Press and the No Starch Press logo are registered trademarks of No Starch Press, Inc. Other product and company names mentioned herein may be the trademarks of their respective owners. Rather than use a trademark symbol with every occurrence of a trademarked name, we are using the names only in an editorial fashion and to the benefit of the trademark owner, with no intention of infringement of the trademark. The information in this book is distributed on an As Is basis, without warranty. While every precaution has been taken in the preparation of this work, neither the author nor No Starch Press, Inc. About the Author. Craig Smith craigtheialabs. Theia Labs, a security research firm that focuses on security auditing and building hardware and software prototypes. He is also one of the founders of the Hive. Hackerspace and Open Garages Open. Garages. He has worked for several auto manufacturers, where he provided public research on vehicle security and tools. His specialties are reverse engineering and penetration testing. This book is largely a product of Open Garages and Craigs desire to get people up to speed on auditing their vehicles. About the Contributing Author. Dave Blundell accelbydavegmail. Moates. net, a small company specializing in pre OBD ECU modification tools. He has worked in the aftermarket engine management sphere for the past few years, doing everything from reverse engineering to dyno tuning cars. He also does aftermarket vehicle calibration on a freelance basis. About the Technical Reviewer. Eric Evenchick is an embedded systems developer with a focus on security and automotive systems. While studying electrical engineering at the University of Waterloo, he worked with the University of Waterloo Alternative Fuels Team to design and build a hydrogen electric vehicle for the Eco. CAR Advanced Vehicle Technology Competition. Currently, he is a vehicle security architect for Faraday Future and a contributor to Hackaday. He does not own a car. FOREWORDThe world needs more hackers, and the world definitely needs more car hackers. Vehicle technology is trending toward more complexity and more connectivity. Combined, these trends will require a greater focus on automotive security and more talented individuals to provide this focus. But what is a hacker The term is widely corrupted by the mainstream media, but correct use of the term hacker refers to someone who creates, who explores, who tinkerssomeone who discovers by the art of experimentation and by disassembling systems to understand how they work. In my experience, the best security professionals and hobbyists are those who are naturally curious about how things work. These people explore, tinker, experiment, and disassemble, sometimes just for the joy of discovery. These people hack. A car can be a daunting hacking target. Most cars dont come with a keyboard and login prompt, but they do come with a possibly unfamiliar array of protocols, CPUs, connectors, and operating systems. This book will demystify the common components in cars and introduce you to readily available tools and information to help get you started. By the time youve finished reading the book, youll understand that a car is a collection of connected computersthere just happen to be wheels attached. Armed with appropriate tooling and information, youll have the confidence to get hacking. This book also contains many themes about openness. Install Libpcap On Kali Linux more. Were all safer when the systems we depend upon are inspectable, auditable, and documentedand this definitely includes cars. So Id encourage you to use the knowledge gained from this book to inspect, audit, and document. I look forward to reading about some of your discoveries Chris Evans scarybeastsJanuary 2. ACKNOWLEDGMENTSThanks to the Open Garages community for contributing time, examples, and information that helped make this book possible. Thanks to the Electronic Frontier Foundation EFF for supporting the Right to Tinker and just generally being awesome. Thanks to Dave Blundell for contributing several chapters of this book, and to Colin OFlynn for making the Chip. Whisperer and letting me use his examples and illustrations. Finally, thanks to Eric Evenchick for single handedly reviewing all of the chapters of this book, and special thanks to No Starch Press for greatly improving the quality of my original ramblings. INTRODUCTIONIn 2. Open Garagesa group of people interested in sharing and collaborating on vehicle securityreleased the first Car Hackers Manual as course material for car hacking classes. The original book was designed to fit in a vehicles glove box and to cover the basics of car hacking in a one or two day class on auto security. Little did we know how much interest there would be in that that first book we had over 3. In fact, the books popularity shut down our Internet service provider twice and made them a bit unhappy with us. Its okay, they forgave us, which is good because I love my small ISP. Hi Speed. Span. netThe feedback from readers was mostly fantastic most of the criticism had to do with the fact that the manual was too short and didnt go into enough detail. This book aims to address those complaints. Intel Management Engine Drivers, Firmware System Tools. Intel Management Engine Drivers, Firmware System Tools. Last Updated 2. 01. Intel Management Engine Introduction Built into many Intel based platforms is a small, low power computer subsystem called the Intel Management Engine Intel ME. This can perform various tasks while the system is booting, running or sleeping. It operates independently from the main CPU, BIOS OS but can interact with them if needed. The ME is responsible for many parts of an Intel based system. Such functionality extends, but its not limited, to Platform Clocks Control ICC, Thermal Monitoring, Fan Control, Power Management, Overclocking, Silicon Workaround resolves silicon bugs which would have otherwise required a new cpu stepping, Identity Protection Technology, Boot Guard, Rapid Start Technology, Smart Connect Technology, Sensor Hub Controller ISHC, Active Management Technology AMT, Small Business Advantage SBA, Wireless Display, Play. Ready, Protected VideoAudio Path etc. For certain advancedcorporate features AMT, SBA etc the ME uses an out of band OOB network interface to perform functions even when the system is powered down, the OS andor hard drivers are non functional etc. Thus it is essential for it to be operational in order for the platform to be working properly, no matter if the advancedcorporate features are available or not. Intel Converged Security Engine Introduction The evolution of Intel Management Engine into a unified security co processor, running x. Minix based Operating System. It was first introduced in 2. Skylake CPUs working alongside 1. Sunrise. Point PCH. The CSE hardware can run Management Engine ME 1. Trusted Execution Engine TXE 3 or Server Platform Services SPS 4 firmware. So there are a total of three families of CSE based firmware CSME CSE ME, CSTXE CSE TXE and CSSPS CSE SPS. This is a collection of everything Intel CSME related. To extract most of the files below you need to use programs which support RAR5 compressionDisclaimer All the software firmware below comes only from official updates which were provided and made public by various manufacturers The System Tools are gathered and provided with the sole purpose of helping people who are out of other viable solutions. Thus, they can be extremely helpful to those who have major problems with their systems for which their manufacturer refuses to assist due to indifference andor system age. A. About Intel MEI Drivers. The latest v. 11. Intel chipsets from 8 Series up. Users of 6 7 series systems must use the latest v. Users of 5 series lower systems must check Section D to find the driver they need. In order to check your current installed version, use MEInfo tool as instructed below. Notice For Windows 7 only Intel MEI Driver uses KMDF WDF 1. Windows 8 up but not Windows 7 or earlier. Make sure you install Kernel Mode Driver Framework KMDF version 1. Intel MEI Driver. Otherwise, a yellow bang will appear on Intel MEI device upon installation. Follow instructions in this link KB2. Note To extract some of the files below you need to use programs which support RAR5 compression A1. Intel MEI Driver Only. These packages contain only the Intel MEI driver without any additional software or system services. They are compatible with both Consumer1. MB and Corporate5. MB systems. Since the software and system services are not really needed for Consumer1. MB systems, users of such systems should install the Drivers only section A1. The MEI Only Installer is the setup file from Intel which allows easy installation and adds a Control Panel entry for quick driver removal. For those who want to install the actual driver files manually via Device Manager, download the INF packages. Note The MEI drivers listed above are part of the complete Drivers Software packages found at section A3. A newer Drivers Software package has newer Software but the actual MEI driver may still be an older version. MEI Only Installer 1. Program Za Hakovanje Sajtova here. MEI v. 11. 7. 0. 1. MEI Only Installer v. MEI v. 11. 0. 5. 1. Note The MEI Only Installer includes the INF for manual installation and allows easy installation of the latter. However, since we cannot always find the latest MEI Only Installer, it is advised to use the INF for manual installation in case its version is newer. A2. Intel SOL Driver Only. This package contains only the Intel SOL driver without any additional software or system services. It is compatible only with 5. MBCorporate systems. If the software and system services are required in case of remote management etc, users of such systems should install the equivalent complete Drivers Software package section A3. Note The SOL driver listed above is part of the complete Drivers Software packages found at section A3. A newer Drivers Software package has newer Software but the actual SOL driver may still be an older version. Note The SOL driver is not really a driver but rather a placeholder INF file which assigns a correct device name at Device Manager and prevents the latter from showing the yellow exclamation mark of No driver was found for this device. Its the SOLs equivalent of Intel Chipset INF utility. A3. Intel MEI Drivers Software. These packages contain the Intel MEISOL drivers with their respective software system services. Its important to install the correct package depending on your Consumer1. MB or Corporate5. MB system. Note ME Drivers Software v. MEI v. 11. 7. 0. 1. ME Drivers Software v. MEI v. 11. 0. 5. 1. B. About Intel CSME Firmware Updates. Intel ME firmware is divided into two main categories ConsumerSlim1. MB SKU for Consumer systems and Corporate5. MB SKU for Corporate systems. To understand your exact SKU, manual research on your hardware may be required first. Usually MEInfo, MEManuf verbose and ME Analyzer by loading your BIOS file can help you sort most system specific details out. General Notice Be careful of what firmware your download relevant to your system. First, make sure that you know what series it is examples Z7. B1. 50 1. Then run MEInfo Tool and check the FW Version line to determine your ME firmware version examples 8. Usmt There Is A Problem With This Installer Package Windows here. All the firmware below correspond to a specific series which comes with a specific ME firmware version example For 7 Series systems which come with ME firmware v. Security Version Number SVN All ME 8. Security Version Number SVN like 1,2,3 etc which is used to control the possible upgradedowngrade paths provided by Intels FWUpdate tool. The SVN gets incremented if there is a high or critical security fix that requires a Trusted Computing Base TCB recovery operation, a significant event in the life cycle of the firmware which requires renewal of the security signing keys in use. A downgrade to a lower SVN value via FWUpdate tool is prohibited whereas an upgrade to the same or higher SVN is allowed. For example if your current firmware has a SVN of 2, you can update to another firmware with SVN 2 for example 3 but you cannot downgrade to another firmware with SVN lt 2 for example 1. Trying to flash a firmware with lower SVN will result in the error The image provided is not supported by the platform or similar.