ECU Firmware Analysis

# Methods to obtain firmware:
# 1. OEM update files (official downloads)
# 2. Extract from update media (USB/SD)
# 3. Dump from chip (JTAG/SWD)
# 4. Read via UDS services

# UDS firmware read (if supported)
# Service 0x23 - Read Memory By Address
# Service 0x35 - Request Upload

# Chip dumping tools
# - J-Link
# - STLink  
# - Bus Pirate
# - ChipWhisperer

# Common ECU processors:
# - Renesas RH850
# - Infineon TriCore
# - NXP MPC5xxx
# - ARM Cortex variants

# Identify firmware format
binwalk firmware.bin
file firmware.bin
strings firmware.bin | head -100

# Extract embedded files
binwalk -e firmware.bin

# Load in Ghidra/IDA
# Identify processor architecture
# Find base address (look for pointer tables)

# Look for:
# - Security seed algorithms
# - Encryption keys
# - Debug interfaces
# - UDS service handlers
# - CAN message handlers

# Security Access (0x27) seed algorithm
# Often uses simple algorithms:
# - XOR with constant
# - Lookup table
# - Linear calculation