NexMon retweeted
Meet the MASTERS of wireless reverse engineering! @kalilinux NetHunter Episode 2 is out now! It was a pleasure to have the @nexmon_dev team on 📱⌚📡 @offsectraining youtu.be/6FNd77iu2W0
YouTube
English
NexMon
156 posts
NexMon
@nexmon_dev
NexMon is a firmware patching framework for the BCM4339 WiFi firmware of Nexus 5 smartphones.
Darmstadt, Germany Joined Ağustos 2016
74 Following754 Followers
NexMon retweeted
@jiska___ @LiveOverflow nexmon.org for reverse engineering and patching of broadcom/cypress wifi firmwares.
English
Do you know any (large) community-driven reverse engineering projects?
English
NexMon retweeted
We published a pre-print paper about AirGuard. How does the app work? How does it perform against the iOS tracking detection and what can we learn from the anonymous data shared by the user?
arxiv.org/abs/2202.11813
English
NexMon retweeted
The remaining @acm_wisec tutorials are online: open-sourcing research projects by Milan (@seemoolab), firmware reverse engineering with Ghidra by @ghidraninja, firmware rehosting with avatar2 by @nSinusR and details on a 5G testbed by @gvinevere (@5g_lab & @ComNets_TUD).
Jiska@naehrdine
A new tutorial format at @acm_wisec features practical tools for wireless research. 👩💻📱📶 SDR intro by @bastibl, baseband fuzzing by @domenuk, iOS in-process fuzzing by @ttdennis & Bluetooth firmware mods by me. Ping me if you want to join as speaker. sites.nyuad.nyu.edu/wisec21/tutori…
English
NexMon retweeted
The paper is online – reverse engineered details on WiFi password sharing and Handoff on Apple devices.
usenix.org/system/files/s…
@[email protected]@seemoolab
Our paper “Disrupting Continuity of Apple’s Wireless Ecosystem Security” has been accepted by Usenix Security 21. It details in reverse-engineering private protocols on Apple‘s Hard- & Software and it includes two reversed protocols: Handoff and WiFi Password Sharing. #usesec21
English
Very nice that you finally found the shared memory regions between Wi-Fi and Bluetooth chip. As nexmon just patches the Wi-Fi firmware before loading it, we could try to load a patched Wi-Fi firmware using the Bluetooth chip and then reset the Wi-Fi chip to start it.
Jiska@naehrdine
Code execution on a Broadcom Bluetooth chip leads to code execution within Wi-Fi. This has a couple of interesting implications for utilizing Wi-Fi without @nexmon_dev 📱, Wi-Fi debugging 🐛, and exploitation 💥 More details on CVE-2020-10367 (unpatched): naehrdine.blogspot.com/2021/04/blueto…
English
Happy Easter! Today I published our monitor mode and frame injection patches for the BCM4375 Wi-Fi chips installed in Samsung Galaxy S10 and S20 smartphones.
I am still looking for access to a Galaxy S21 to analyze its firmware. nexmon.org #nexmon
English
NexMon retweeted
We reverse-engineered @Apple's Find My network for tracking offline #Bluetooth devices. Corresponding paper at @PET_Symposium. Create your own #AirTags today: github.com/seemoo-lab/ope…
English
@enovella_ S10 patch is ready just need to find some time to publish it.
English
Take a look at github.com/reinhardh/dna_… to decode the first episode of biohackers encoded in DNA on de.biohackersnetflix.com
English
NexMon retweeted
@naehrdine found a new PRNG related vulnerability in the Galaxy S8's Bluetooth chip.
spiegel.de/netzwelt/gadge… bild.de/digital/smartp…
github.com/seemoo-lab/int…
English
@naehrdine Nice work does it also work for ARM or also for the D11 ucode (b43 assembly)?
English
NexMon retweeted
Since people were asking how it works internally, here is Jan's final presentation, which covers the most important aspects why ARM Thumb2 disassembly was problematic and how the binary-only approach works. (9/8)
github.com/seemoo-lab/pol…
English
We just released Polypyus, a binary-only diffing tool programmed by @freebejan that runs independent from Ghidra and IDA and integrates into the workflow of other diffing tools. (1/n)
github.com/seemoo-lab/pol…
English
Jan just released Frankenstein, the Broadcom/Cypress Bluetooth firmware emulator that enables fuzzing and further kinds of debugging. It works within a fully-functional Linux BlueZ stack and features virtual modem input. (1/2)
github.com/seemoo-lab/fra…
English