VW_Flash VS bevy

I did find an older VW "emergency start" product that claims to only work with Bosch MED17 and MED9, and I suspect it's using a memory-access primitive (either UDS or CCP) to release the immobilizer.

It's trivial to disable an immobilizer in software by re-flashing the ECU, yes, but modern ECUs have two strong protections against this:

* Cryptographic signature checking against update/re-flash payloads (I've done extensive research on these on VW Continental ECUs - https://github.com/bri3d/VW_Flash )

and an even better and more obvious protection:

* The ECU application software won't descend into the re-flash software (Customer Bootloader) unless the immobilizer is free (a valid key is present).

This is a lot of what helps to reduce surface area from an "emergency start" style attack to an AKL attack - now that the Customer Bootloader won't start without the Immobilizer being unlocked, an attacker needs to remove the control unit to flash it with a Supplier Bootloader exploit ( https://github.com/bri3d/simos18_sboot ) or physical access (BDM/JTAG).

This year I don't anticipate having much free time, so I'm trying to engage more contributors in side projects,

* Automotive ECU tooling, https://github.com/bri3d/VW_Flash

* DJI FPV forward/reverse/all sorts engineering, https://github.com/fpv-wtf

I've been working a lot with various folks using Discord and contributions are gradually shifting from me towards others, which has been great to see. As the old adage goes, teaching a project is truly the final form of knowing one - much harder than hacking alone, but ultimately more fulfilling.

When I started my automotive ECU journey my goal was to demystify the "tuning" scene for a broader software engineering community, and I think I've generally been successful at this.

This week, as most weeks, I split my time outside of the day job and my other hobbies and obligations between Discord collaboration, Ghidra, and VSCode:

https://github.com/bri3d/VW_Flash - Flashing tools for select control modules in VW MQB and now PQ35 platform cars. This week I'm working on old stuff: a simpler exploit chain for older Simos ECUs, as well as tweaks to expand support to older DSG control units used in PQ35 platform vehicles.

https://github.com/fpv-wtf/msp-osd - I pushed a rearchitect of this on-screen-display overlay system for DJI FPV Goggles last week that seems to have sorted out a lot of issues - I switched from just passing through the OSD drawing messages from the Flight Controller to a system where the video transmitter maintains the OSD character buffer and sends a compressed representation of the screen state. This makes the system much more robust to packet loss in situations where the Flight Controller sends delta updates rather than frame-at-a-time.

I only really started publishing Open Source projects a year or two ago, and while they're pretty much my worst code by any objective measure, I've met some great people and really enjoy working on these. It's fun making things that achieve a goal without so much pressure of deadlines, stakeholders, and competing priorities.

VW_Flash: https://github.com/bri3d/VW_Flash/blob/master/docs/docs.md . Modern UDS control unit flashing: Preconditions RemoteRoutine, Programming Session, SA2 Seed/Key, Workshop Identifier, RequestDownload, TransferData, ExitTransfer, Checksum RemoteRoutine, rinse and repeat. Pretty much the same for any UDS control unit. Other manufacturers have some little tweaks to the Preconditions and Workshop Identifier, but conceptually this is how UDS flashing works overall. Also contains examples of modern control unit encryption (rolling cipher for Temic DQ250, crappy XOR for Simos8, AES for Simos12 and up and DQ381) and checksums (mostly CRC based, some header-defined, some not). Crash course in SBOOT/CBOOT/ASW/CAL layout of modern control units.

That's pretty cool! I wonder how properly they were really signed - there are _so many_ mistakes even in systems that at least don't use an example key off the Internet.

The most common ones I know of are:

* Out-of-bounds write issues allowing "signature was validated" flags to be overwritten in Flash memory, like https://github.com/jglim/UnsignedFlash

* State machine mistakes, like https://github.com/bri3d/VW_Flash/blob/master/docs/docs.md - allowing Flash to be written again after it was already written, without an erase first.

* Filesystem parsing mistakes, like those in a number of VW AG head units: https://github.com/jilleb/mib2-toolbox/issues/122

* The use of RSA with E=3 and inadequate padding validation, like https://words.filippo.io/bleichenbacher-06-signature-forgery... .

* Failure to understand the system boundaries, like in the second part of https://github.com/bri3d/simos18_sboot where "secret" data can be recovered by halting the system during a checksum process.

* Hardware fault injection issues, as used in https://fahrplan.events.ccc.de/congress/2015/Fahrplan/system... .

Fundamentally this is of course, a very hard problem, since in the "protect against firmware modification" case, the attacker has physical access. But, compared to the state of the art in mobile devices and game consoles, automotive stuff is still way behind.

Here is link number 1 - Previous text "My"

No, this EPS control module is remarkably primitive even by late 2000s standards and several generations behind today's state of the art.

More modern control modules with a bit more resource available to them will use AES as the symmetric encryption (although there are also fixed-key XOR schemes and custom stuff used like this: https://github.com/bri3d/VW_Flash/blob/master/lib/decryptdsg... ).

The keys and even IV are usually fixed across a "model line" of ECUs, so once a decrypted flash memory can be extracted, this isn't much of a protection measure, but it's a lot better than XOR.

Then, in more modern control units, flash areas are also usually protected by both a checksum (usually some CRC permutation, although cute tweaks and random nonsense are common here too) and some form of digital signature.

I have been reverse engineering automotive ECUs for a while now - https://github.com/bri3d/VW_Flash . It's a nice change from my day job in enterprise engineering management, and I've met some fun people and taught several folks a lot of new concepts, which is always extremely rewarding.

My latest project has been reverse engineering the data-flash encryption in Simos18 ECUs. After some work, it oddly appears the encryption algorithm used is Mifare Hitag2. I'm hoping to be able to re-encrypt NVRAM channels soon, although the overall data flash "filesystem" / channel-system layout needs some more work before I am ready to release my findings.

3) For highly specialized applications, additional hardware is necessary. For example, on modern ECUs, often read/write access via diagnostic protocol is secured via encryption and signature validation, so to flash custom firmware requires a bypass of these measures. Sometimes this bypass can be via a vulnerability in the diagnostic protocol requiring no additional hardware, like on VW Simos18 , but other times the bypass requires manipulating the control unit beyond what the diagnostic port allows - custom serial protocol, specific sequences of GPIO manipulation, or PWM signals applied to specific pins.

Bevy. A very young engine where you need to write the game entirely in Rust—that was appealing. But fatal flaws overshadowed everything: no editor, the engine brutally enforces the ECS approach, and the game's architecture must literally bend to fit this paradigm. So, you won't migrate to another engine at all—you just throw away all the code and start from scratch.

Missing one of the best choices as long as "maturity" isn't on the top of your list: Bevy - https://bevyengine.org/

Game engine written in Rust, leveraging ECS in almost every place and way, with a really capable WASM export option. Wrestling ECS for the first time might take you some time, but in my experience helps you keep game code as clean and decoupled as game code could be.

I don't see WASM/WebGPU changing anything when it comes to gaming, as an industry, personally. 3d visualizations and interactive websites? Yeah definitely a nice improvement over WebGL 2, if years late.

WebGPU is pretty far behind what AAA games are using even as of 6 years ago. There's extra overhead and security in the WebGPU spec that AAA games do not want. Browsers do not lend themselves to downloading 300gb of assets.

Additionally, indie devs aren't using Steam for the technical capabilities. It's purely about marketshare. Video games are a highly saturated market. The users are all on Steam, getting their recommendations from Steam, and buying games in Steam sales. Hence all the indie developers publish to Steam. I don't see a web browser being appealing as a platform, because there's no way for developers to advertise to users.

That's also only indie games. AAA games use their own launchers, because they don't _need_ the discoverability from being on Steam. So they don't, and avoid the fees. If anything users _want_ the Steam monopoly, because they like the platform, and hate the walled garden launchers from AAA companies.

(I work on high end rendering features for the Bevy game engine https://bevyengine.org, and have extensive experience with WebGPU)

I was working through an example in the repo for the Bevy game engine recently and came across this code

That's possible. I did spend quite a bit of time tinkering with compiler flags, and followed the recommendations.

Some notes I found just now seems to agree with my results, though: https://github.com/bevyengine/bevy/issues/3978#issuecomment-...

I cannot recommend immediate mode GUI programming based on the limitations I've experienced working with egui.

egui does not support putting two widgets in the center of the screen: https://github.com/emilk/egui/issues/3211

It's really easy to get started with immediate mode, it's really easy to bust out some UI, but the second you start trying to involve dynamically resized context and responsive layouts -- abandon all hope. The fact it has to calculate everything in a single pass makes these things hard/impossible.

... that said, I'm still using it for https://ant.care/ (https://github.com/MeoMix/symbiants) because it's the best thing I've found. I'm crossing my fingers that Bevy's UI story (or Kayak https://github.com/StarArawn/kayak_ui) become significantly more fleshed out sooner rather than later. Bevy 0.13 should have lots more in this area though (https://github.com/bevyengine/bevy/discussions/9538)

I've also been enjoying building My First Game™ in Bevy using ECS. The community around Bevy really shines, but Flecs (https://github.com/SanderMertens/flecs) is arguably a more mature, open-source ECS implementation. You don't get to write in Rust, though, which makes it less cool in my book :)

I'm not very proud of the code I've written because I've found writing a game to be much more confusing than building websites + backends, but, as the author notes, it certainly feels more elegant than OOP or globals given the context.

I'm building for WASM and Bevy's parallelism isn't supported in that context (yet? https://github.com/bevyengine/bevy/issues/4078), so the performance wins are just so-so. Sharing a thread with UI rendering suuucks.

If anyone wants to browse some code or ask questions, feel free! https://github.com/MeoMix/symbiants

These days, some game engines have done pretty well at making compute shaders easy to use (such as Bevy [1] -- disclaimer, I contribute to that engine). But telling the scientific/financial/etc. community that they need to run their code inside a game engine to get a decent experience is a hard sell. It's not a great situation compared to how easy it is on NVIDIA's stack.

[1]: https://github.com/bevyengine/bevy/blob/main/examples/shader...

This is the API you need: https://github.com/bevyengine/bevy/pull/9774