Thank you for your feedback! While the techniques we show apply to any IoT / embedded device (TVs, set top boxes, smart speakers, smart home appliances, cameras, enterprise firewalls, car ECU, etc) we really like showing examples on routers. This is because routers are very cheap and easy to get, share lots with common with most IoT devices. Not all routers will have UART, but in our experience 90% do. You could start with TP-Link TL-WR841N. It's quite cheap and could be a good start!

instablaster...

Routers. I find them all the time next to bins 🗑

@@Jimfowler82 that's right, you could use one to that you know a target uses and see if you can make exploits to test on that same brand router? Other than that.....the router is probably in the bin for a reason? Or people just don't care and upgraded to a newer connection that the router doesn't support (because it's branded and locked to a specific network), and in that case....the best you could do is "unlock" the router to use firmware supported on other networks? You can inject features that are supported on the hardware, that are not coded into the firmware interface? You can white list and black list different services& connections as do the OEMs? You can unlock things that your current ISP doesn't want you to get access to, or access is provided through different hardware without the restriction etc? So if you see a router just like yours and you want to hack around with some things; you can do it safely without taking your household off the internet while you try fixing it? Lol

@@Jarmezrocks in the U.K. it seems quite often people change isp companies and just throw the old router away. I found one last year & connected the uart it’s an interesting process that gives you a decent understanding of how the hardware & software work.

In school: You will need to learn these 10,000 different methods! In practice: There's like 3 ways to do it most of the time.

@@joshuamahon260 In youtube comments: Proving you couldn't find a use for knowledge!

I bet there is a utility to auto find the baud rate. Idgaf about manually calculating transfer speeds.

What is the 3.3 or 5 volt of the uart for? I don't see that they use it and it comes there on the USB! If I do it on a camera as they say in the video, I don't need tftp or is that mandatory? I'm bad at this and I don't understand tftp. I damaged my camera by installing the wrong firmware but it turns on but I can't connect to it anywhere, I only see the infrared LEDs and that's it. Do you think this works with that software in the tutorial?

Absolutely amazing! I can totally imagine how satisfying that experience must have been. Ah, those were the days!

@@ulysses_grant I still have them and the source code. They helped me get a good job at DEC.

I hadn't been born yet😂

I don’t want to hack hack anything; I just would love to be able to take my old broken smart devices with generally powerful chips and Linux - I can list what I’m working on if interested- and repurpose them. For instance I have a 22 in touch screen used in advertising and ran android it no longer works. I got uart logs, I can even send commmands over uart though unreliably- usually the boot log washes it out but a Simple “ls” will output in between log lines. I don’t yet understand what to do next, boot loaders, getting it to boot My Linux. I don’t understand even a smidge of android- so that’ll have to to

It’s a rock chip rk3288 but I also have several other projects, two with ingenic JZ4775, a very important one I need to fix with a vacuum octeon plus with usb thumb drive rather than spi? And another I have three of mediatek or something. Discarded yi cameras. But I can’t get all the way there like you guys . I have 75% the skills but I neeed the last 25%

Great job! Let us know if you find any vulnerabilities!

how you login ? i mean the username password ?

Thank you. We are just getting started!

We don't need videos like this. We have degrees in electronics and already understand UARTs and communication protocols and understand how to use oscilloscopes and logic analysers.

Glad you liked it!

It takes no more than 3 minutes to try the most common settings, if none of them work then you can pull out the oscilloscope but almost always you will save the hassle

@@victornpb Also, from what I've experienced with non standard rates, if you're off by 10-20 hertz, you'll always see recognizable characters to a large extent.

You can usually be off by 1-2%. The UART peripheral will not even notice that. It depends on the sample rate of the peripheral and the number of samples it takes per symbol.

Yes, screen is actually our default but wanted to use minicom in the video as it's more recognizable. Thanks for the heads up.

@@FlashbackTeam Thanks for reply and thanks in general for your whole impressive work. Will you be publishing anything related to HackRFOne device? And one more question - this logic analyzer is original Saleae device? Is it very expensive?

It's a nice gift to have full UART access and that happens way often as some may think. Also, consider that even if UART is disabled in production there are still ways to enable it as we have done many times, even Tx is very useful already. But if that doesn't work you just adapt your approach.

@@FlashbackTeam you are right! We develop only products or parts which are not consumer grade. For example parts of DNA sequencers etc. We have to protect your IP and that's the reason why we put a lot of effort in protecting mechanisms.

@@FlashbackTeam Some chips allow you to blow a fuze inside them to permanently cut any UART from the pins. However it is not often enough used. Which is why such attacks work relatively often.

This. Saying "uart protocol" makes the hairs on the back of my neck stick up. Universal Asynchronous Receiver / Transmitter. It's hardware component, used to be a discrete chip but these days it's usually a macrocell in the CPU (or other VLSI chip) design.

Thanks. I got it from here: www.thingiverse.com/thing:2427726

got an oscilloscope? it would probably make the problem apparent

Little late maybe? You can guess by trying RX/TX. Learned that when I stomped with a device that had the wrong pin marking, instead of saying the SoC TX and RX, it said "Here you should comnect your RX (being the SoC TX" Just takes more time, put the pins one way, try all the common baudrates, reverse and try again.

Also, the autoboot thingy, depends on the bootloader, I've seen devices that only stop booting with a specific key (I'm pointing at you, Dahua devices!) Where only the asterisk key worked. Didn't figure that myself, used to work with the brand haha.

As long as you have an isolated power supply and you are not getting shocked there is no ground voltage and you can join both grounds with no problem, you can connect any 3.3v tx into a 5v rx no problem but the other way 5v tx to 3.3 needs a voltage divider, i usually use a resistor and a led for that as the led will drop the voltage to 3v and give feedback as a bonus.

Thanks! Synchronization is only determined by the baud rate that sender and receiver need to set to the same value. It ensures synchronization of read and write. Start bit is always a LOW value (logical 0) and Stop bit can be 1, 1.5 or 2 bits HIGH value (logical 1) at the end of the UART frame.

I believe it depends on the idle state of the data line. Start will always be inverse of idle level and stop will be same level as idle. @@FlashbackTeam

That's a trick we also commonly use :) But in many cases, this is very hard to achieve, as the firmware might be signed, encrypted, have some protection and if it goes wrong you can brick the device. This UART method should be your first approach, as it can be very quick and easy, and give you an instant root shell. If that doesn't work then you should explore alternatives like the one you described!

@@FlashbackTeam Thanks for the answer, as you said I mentioned about the devices firmware available to download and unencrypted

@@selimeneskaraduman6935 Sure, but keep in mind that even if the device's firmware is available to download and unencrypted, the device itself might only accepted signed firmware. Even if it's not signed, it expects a certain layout or checksum or something like that which might be very hard to pull off in practice. But you're thinking right, it can be done and we have done it. We might show it in a future video too!

@@FlashbackTeam Look forward to see that :)

You could start with TP-Link TL-WR841N. It's quite cheap and could be a good start. There are really a lot of UART-USB devices on amazon, just take the one which has good reviews and has a good price for you and you should be fine. I think the risk of frying the board is quite small if you make sure you discover the ground and vcc pin of the board and you wire things fine.

@@FlashbackTeam thanks for the response. Please keep up with this channel

🇵🇹 🇵🇱

Sort of experience. The more you work with embedded the faster you are able to identify various elements of it. Hence we have shown different types of UART interfaces in the video to emphasize on it. Normally a special connector would be needed for that interface. But if we didn't have it we would simply solder wires into it.

We got it from here: www.thingiverse.com/thing:2427726

Check if pin and Tx line are connected connect. You can use continuity mode for this. Also, UART might be disabled by a fuse in that case you might be unlucky.

That’s a fantastic analogy!

Just search for any USB-to-UART adapter. They will register to your computer as a device, i.e. /dev/ttyUSB0. They have FTDI chips that is used to speak UART protocol.

you can use arduino as that device by connecting the reset pin to arduino to gnd and then using its tx rx vcc and gnd pin , same as in ftdi

"UART" is not a protocol, it's a device (here built into the processor) that provides an asynchronous serial port to a system. The easiest way to refer to it is just "serial port", or "RS-232" if you ignore that the voltage levels are wrong.

te funciono En que Marca y modelo Lo intentaste??

Do you have those connectors labeled? If not, you can use multi-meter to find ground and connect logic analyzer to the remaining 2 pins and take a trace. Because it could also be used for a different protocol, for example I2C. With a logic analyzer you can apply some auto-discovery.

Yes, I have the breakdown and I did take a voltmeter to the pins. One side had a constant 3.16 V and the other side had a constant .5 V. There was no fluctuation in voltage. The total voltage of the pack was 22.6 V.