NumWorks open source calculator

[Claudio L.]

(08-31-2017 09:55 PM)Paul Dale Wrote:  Without a form of secure boot, upgrading will be possible. It could be very hard.

I'd expect there to be a small boot loader which runs the calculator firmware. If this boot loader is properly checking for cryptographic signatures, you're not loading a new image onto the device while it is there.

This doesn't stop you necessarily, it might be possible to attach debugging headers to the board and to then replace the boot loader with your own. Soldering will be required and the case will have to be opened. Even if the debug pins aren't run out somewhere nice (they almost always are), it could still be possible to hook them up -- I've seen loose wires pushed under a BGA chip to contact an internal pin before.

If this approach isn't possible, the processor can be replaced by another which you've programmed specially.

Far more likely is the boot loader doesn't implement the cryptography properly and there is an exploitable hole.

The real question is: is it worth the effort? The answer is most likely no. If you are up to doing the kinds of things required, you are probably up to learning the exam material.


Pauli

From the link I posted, the bootloader is in ROM, comes from the manufacturer of the MCU, and has the ability to reflash the firmware through UART, USB, etc. and doesn't have any cryptography. Even if they put a second stage bootloader to check a signature, you can simply flash another one with the factory bootloader. It is marketed as an open platform and I think it is, there's no need to find hidden ways to hack it.
I have no interest in bypassing exams, but if it's as easy as it seems to be, the main concern is the exam boards pulling their certification, then they can't sell and become instant vaporware.
The big question is if our community should adopt it as an open platform and port our favorite firmware projects to it, with the risk that all our effort can go to waste if they pull out of the market.
It's a risky move.