Skip to content

Instantly share code, notes, and snippets.

View hn's full-sized avatar

Hajo Noerenberg hn

View GitHub Profile
@mnaberez
mnaberez / nec_78k0_flash.md
Last active November 12, 2024 05:43
NEC 78K0 Flash Vulnerability

NEC 78K0 Flash Vulnerability

Overview

The microcontroller that I studied was removed from a Volkswagen car radio manufactured by Delco (now Delphi). The chip had only Delco markings on the package. It was decapsulated and the markings "NEC D78F0831Y" were found on the die. I reverse engineered the device definition files for the NEC toolchain (RA78K0) and determined that the uPD78F0831Y is a subset of a documented chip, the uPD78F0833Y. The '833Y adds 3 more timers, extended I2C functionality, and adds registers that allow firmware running on the '833Y to reprogram the flash ("self-programming"). Otherwise, the '831Y and '833Y are the same.

The uPD78F0831Y uses the NEC 78K0 core. Note that NEC (now Renesas) produced a number of incompatible cores with similar names such as 78K0S and 78K0R. Those