Uniden BC296D Manuale Utente

Reversing P25 Radio ScannersLet's beat a dead horse.

Adventure time!

Hardware recon

Interesting Hardware bits● Main radio○ Renesas m16c/62P (m16c/60 serie) 256k ROM 20k RAM 15-32 mhz 16 bits I/O○ User config is stored in eeprom (a

Now that we know that● What should we do?

Firmware file analysis● Let's look at the firmware update file● Yay! Not binary.

Firmware file analysis● Motorola S-Record ○ Nope IDA, intel s-record does not exists● Stolen from Wikipedia ● Start code, one character, an S.● Record

Tool #1: pysrec● https://github.com/gabtremblay/pysrec● Motorola s-record analysis tool● Validate checksum, rebuild checksum○ In fact, it will replace

Firmware file analysis● Let's take a record in our file● S2240A0120DC22C330DE22C330E321C330E322C3E0EC21C3E0EC22C3E0F121C3E0F122C33011● checksum(2

Firmware Updater

Firmware Updater● ~2 MB of pure Visual Basic 6 clusterfsck● Supports about 10 different scanner protocol○ in a "Copy-Paste" fashion.● Not &q

Super Quick Presentation● Founder of an obscurely named infosec company (see footer)○ founded at the end of 2011○ infosec dev, pentests○ president, le

Firmware Updater● Plan A: Buy the Renesas hardware to dump the chip content● (Edit) Plan A1: Buy a Die Datenkrake● Plan B: Reverse the "scramblen

Scramblencryption● Firmware file is partly scrambled and partly weakly encrypted● Most data blocks uses a position rot(x) scrambling algorithm● Code b

Plan C - As lazy as it gets● The unscrambling is done at the updater level before the actual firmware update● The update protocol *should* be much sim

Tool #2: BearMock

Tool #2: BearMock● https://github.com/gabtremblay/Bearmock● Fakes a BC296D (or a BCi96D)● Use it with com0com or something similar● Outputs a descramb

Next● We now have a descrambled s-record file ● Epic +- 2 year pause○ Waiting for IDA to support Renesas m16c● IDA 6.2: To the IDA cave!

Inside IDAWUT!?

Inside IDA● The cpu is supported but it's not common renesas code● Code analysis is broken :(● Multiples entry points○ Triggered by boot or keypr

Tool #3: m16clean● https://github.com/gabtremblay/idabearclean● (Very) Simple helper IDA python script to help analysisThis is a blatant lie! Consts a

Firmware code layout

What it's all about● Uniden BC296D● Complete process from firmware update file to code execution● Toolset presentation● AES over P25 still stand○

Firmware code structure● System wide consts○ Model number, version, regional tags● Main radio program consts○ Screen display, menus errors● Smaller si

The code is "signed"● Some kind of checksum signature at runtime● However you control the part of the code which tests it.○ Locate the corru

Tool #4-5: Bearflash/BciFlash● https://github.com/gabtremblay/bearflash● https://github.com/gabtremblay/bciflash● Tools to flash your custom firmware

Some differences● Some protocol difference● The daughter board has a fixed 9600 bps update speed● The main radio updater uses a weird "speed danc

Proof of concept● Just try to flash some modifications to the radio● I am a kind of a science guy● Small tribute to the internet famous "eight eq

Eight Equals D Minus Equation● I am quite funny.

What about the newer models?● BCD346T, BCD396XT, Home Patrol● They still all uses s-record update files● Files are UNSCRAMBLED● Can't tell for th

Questions?

What is P25 anyway?● Suite of standards for digital radio● "Closed" open standards○ You have to pay for the documentation● Developed by a se

P25, isn't it more like "molesting" a dead horse?● Well... maybe.● Osmocom OP25 did a very good job● multiple p25 support in sdr radios

P25, isn't it more like "molesting" a dead horse?● This talk is not about the protocol● There's still some cool things to reverse○

The Beast● Uniden BC296D● Released in 2002● 9600bps APCO P25 Compatible● Trunk Tracking ~14 types● 25 mhz - 1.3ghz (not continuous)● Many more feature

The Beast (2)● Uniden BCi96D● "Optional" P25 daughter board● P25 Protocol implementation● Audio Decoding -> C4FM/CQPSK DSP

Why this model?● Cheap P25 scanner (~350$ used)● Firmware updates for both components○ Radio○ Daughter Board● Old○ ... so I don't care if I brick