> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/embedded-systems/uart.md). # UART [Universal Asynchronous Receiver-Transmitter (UART)](https://www.bing.com/ck/a?!&\&p=4bfc5342889f95d4953f00644287758eec49f06edbc43df648814cb7efb41f5cJmltdHM9MTc3ODE5ODQwMA\&ptn=3\&ver=2\&hsh=4\&fclid=03e91e11-41ce-615a-19f3-0c77403360ca\&psq=define+UART\&u=a1aHR0cHM6Ly9lbi53aWtpcGVkaWEub3JnL3dpa2kvVW5pdmVyc2FsX2FzeW5jaHJvbm91c19yZWNlaXZlci10cmFuc21pdHRlcg\&ntb=1) is a protocol for asynchronous serial communication without the use of a clock signal. UART is widely used in IoT and embedded devices like routers, smart cameras, etc. These devices expose a serial console on their UART for debugging purposes. Reverse engineers can take advantage of this serial console and potentially spawn a root shell on the device. From there we can inspect the components (e.g. memory, firmware, file system, and bootloader) to discover vulnerabilities. I highly recommend watching the following [video](https://youtu.be/V6m2skVlsQI?si=bw0fTr9St9X6cLGx) to get a simple understanding of the protocol. ## Common Defenses * Password or pin Protected * Random password upon each boot * Read-only console (only prints logs) * Shell might be restricted to limited commands * Physical blocks * Manufacturer disables the serial console before shipping There are assortments of tips and tricks however that reverse engineers take advantage of to circumvent these protections. ### Read-only console Even if the serial console is read-only you can still... * examine boot logs for device specifications * sniff encryption keys and passwords * investigate crash logs from attack attempts * dump firmware You go through the following checklist of questions to identify useful information. * [ ] What services are being started? * [ ] What are the various components on the board? * [ ] Where is the memory? * [ ] Where is the filesystem? ### Physical Blocks If you discover a UART that you suspect is blocked, you can take a multimeter to test for connectivity. Manufacturers may sever the VCC connection as shown in this [video](https://youtu.be/s8s3gvZPc0c?si=kC4dXEfQSfuKjin2\&t=652). ## Identifying UARTs Flashback has a great [video](https://youtu.be/01mw0oTHwxg?si=JHP7eJgq2w5dXds4\&t=293) on identifying UART pins. You can utilize a multimeter or a logic analyzer for identifying which pin is which. * VCC will be a constant voltage (e.g. 3.3V, 5V) * RX will likely be 0V, no incoming information * TX will be fluctuating if it's attempting to send information ## Serial Debugging Tools ### Minicom Minicom is a powerful command-line utility used to communicate with devices through a serial interface. It is especially useful when interfacing with embedded systems, modems, and other serial devices. Minicom acts as a terminal emulation program that allows you to send and receive data on a designated serial port, often found in Linux environments. ```bash $ sudo apt-get install minicom $ minicom ``` ## Glossary | TERM | DEFINITION | | -------- | ------------------------------------------------------- | | Baudrate | Rate at which a device transmits bits (Bits per second) | | | | | | | ## Resources * [how does UART work??? (explained clearly)](https://youtu.be/V6m2skVlsQI?si=bw0fTr9St9X6cLGx) * [Hacker's Guide to UART Root Shells](https://www.youtube.com/watch?v=01mw0oTHwxg) * [Mastering UART Communication: Gaining Access & Extracting Firmware on Unknown Boards](https://www.youtube.com/watch?v=s8s3gvZPc0c) ## Hardware Resources * ## Flashback {% embed url="" %}