A highly suitable group of people to review this topic would be Embedded Systems Security Researchers or IoT Device Reverse Engineers, as the analysis focuses on hardware security architecture, firmware extraction, and binary patching of consumer-grade, location-aware microcontrollers.
Abstract:
This analysis details the non-destructive reverse engineering and firmware modification of a consignment of smartwatches featuring geolocating capabilities (nRF52832, ESP8285, SIMCOM modules) for subsequent repurposing as location trackers. Initial hardware inspection revealed that the main microcontroller's JTAG programming pins (SWDIO and SWCLK) were unintentionally exposed via the charging adapter's microUSB D+ and D- pins, enabling direct, non-invasive access. The firmware was successfully dumped using nrfjprog due to the absence of read/write protection. Utilizing Ghidra, the analyst located the hardcoded server IP address and port by tracing the cellular command string (AT+CIPOPEN=0) in the disassembled code. A targeted patch involving modification of six bytes in the flash memory, coupled with checksum correction, successfully redirected the device's communications to a controlled server, confirming the viability of repurposing the hardware.
Reverse Engineering a Smartwatch: Security and Repurposing
Initial Context: The project began with a consignment of mothballed, geolocating smartwatches intended for reuse as location trackers for vulnerable populations.
Hardware Analysis (Cracking the device open): A physical teardown revealed a PCB utilizing three major ICs: the nRF52832 (main IC, Bluetooth), the ESP8285 (WiFi, used for urban triangulation/location approximation), and a SIMCOM cellular module (communicating via UART).
Unexpected Programming Interface: The crucial discovery was that the nRF52832's JTAG programming pins (SWDIO and SWCLK) were connected to round gold contacts on the PCB, which mated with pogo pins on the charging adapter. These pogo pins, in turn, were wired to the D+ and D- data lines of the microUSB port on the charger.
Non-Invasive Access: This exposed programming interface allowed the analyst to connect a JLink debugger directly through a spliced microUSB charger cable, bypassing the need to physically open the IP67-rated device for subsequent flashing.
Firmware Extraction: Connection via JLink immediately yielded debug output via RTT. The firmware was found to be completely unprotected (lacking read or write protection), allowing a full dump of both the flash and RAM using nrfjprog.
Ghidra Analysis and Objective: The analyst used Ghidra to decompile the bare metal Cortex M0+ code (ARM little-endian). The primary objective was to locate and patch the hardcoded server IP address and port responsible for cellular communications.
Locating the Target Data: The command string AT+CIPOPEN=0 (used to open a connection to the server) was located in the firmware. Tracing its usage led to a function referencing an array stored in the Data RAM section (DAT_20000887).
Patch Implementation: Six specific bytes in the memory corresponding to the IP address (4 bytes) and the port (2 bytes) were identified for modification. A complication arose as the compiler used a movn instruction (Boolean NOT) for loading the port number, requiring an inverse calculation for the patched port value.
Final Reprogramming: A custom Python script was developed to automate the patching process, including updating the firmware checksums. The modified firmware was successfully flashed back onto the watch using Nordic Semiconductor’s Programmer utility, confirming successful redirection of the communication channel.
Key Security Takeaway: The exposure of programming pins via the charging port and the lack of basic read/write protection on the production firmware were highlighted as uncommon and significant security oversights for an IoT device.