> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/embedded-systems/rolling-code-re.md).

# Rolling Code RE

## Glitching Attacks to Dump Firmware of KeyFob

Sometimes in STM8 versions there is an OPTION byte set that disallows dumping of firmware, however, it's set upon startup, and via a voltage fault attaack you could interrupt when that value gets set. Capacitors are in place to help reduce these kinds of attacks, however, you can desolder and remove it

* [ ] Find articles about STM8 glitching attacks 

{% hint style="info" %}
There are cloned programmers (ST-Link Programmers from china) and the original STM8 ST-Link programmers you can order on amazon
{% endhint %}

## RF Side Channels to Dump Firmware of KeyFob

1. analyzing spectogram to ensure we have same frequency
2. Using HacRF
   1. ASK modulation (look into this)
      1. OOK (On/Off Keying) Modulation
   2. Apply bandpass filter to denoise, tinkered w/ noise, center, samples/symbol, error tolerance to demodulate sequence, found the frame size of the button presses on the keyfob
3. Identified PWM signal (Logical 1 is "1110" while 0 is "1000") by pattern-analysis
4. Was able to reverse the rolling code frmae (41 bits)
   1. it's comprised into counters, c0, 1, c2, and c3

## Tools

* GNU Radio
* AutoRFKiller tool integration
* stm8flash to pull the firmware using a JTAG
* GlitchTag
* Faultier board