Black-Box Probing A Security Analysis of Xiaomi's MJA1 Secur...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: http://blog.quarkslab.com/black-box-probing-a-security-analysis-of-xiaomis-mja1-secure-chip.html
• Blog Title: Black-Box Probing: A Security Analysis of Xiaomi's MJA1 Secure Chip
• Suggested Section: Hardware/Physical Access > Firmware Analysis, with generalized subsections under Hardware Hacking > I2C, SPI, and Fault Injection Attacks

🎯 Content Summary

Scope, result, and security impact

Quarkslab performed a black-box security analysis of Xiaomi's undocumented proprietary MJA1 C06CW secure element. The chip is advertised as providing hardware-level protection against replay, man-in-the-middle, and brute-force attacks, with a unique private key and certificate provisioned into each device. The initial targets were the Xiaomi Outdoor Camera BW300...

🔧 Technical Details

Identify an undocumented embedded bus through live pin probing: Probe every pin while the target is operating and classify constant-high or constant-low pins as likely power, ground, or pull-up connections. Compare active signals with common protocol characteristics: UART is asynchronous with independent TX/RX lines, SPI generally requires CLK, MOSI, MISO, and CS, while I2C uses a synchronous clock and shared bidirectional data line. Decode likely I2C traffic to recover the slave address, acknowledgments, and recurring frames. Here, two active lines identified SCL/SDA, address 0x2A, and request 05 00 03 00 02 00 08 58 EF.

Dump an unsupported SPI NAND using a Raspberry Pi: Connect CS, MISO, MOSI, SCLK, 3.3 V, and ground directly to the flash, while holding active-low write-protect and hold pins at 3.3 V. Validate communication with JEDEC command 0x9F. For compatible SPI NAND, send 0x13 with th...

🤖 Agent Actions

Plan:

1. Map the hardware/firmware-analysis pages and inspect at least five relevant files.
2. Compare the blog’s techniques with existing coverage and select one best target file.
3. Add only novel, generalized techniques with numbered citations and references.
4. Review the diff, validate formatting/links, and confirm no forbidden sources were added.
   Repository review is complete. The novel material fits best in the existing I2C page: it lacks a workflow for identifying an undocumented bus, reconstructing the application protocol from host firmware, issuing frames through Linux, and enumerating handlers by response class. SPI NAND dumping and generic fault/side-channel material are either secondary to this analysis or already covered elsewhere, so I’ll keep the update focused in one file.
   Implementation is complete. I’m now checking the edited page for whitespace/Markdown issues, citation consistency, forbidden-source leakage, and whether the mdBook still builds.
   Updated src/todo/hardware-hacking/i2c.md with:

• Live-pin identification of undocumented I2C buses.
• Host-firmware protocol reconstruction workflow.
• Exact CRC preset identification guidance.
• Linux userspace I2C frame injection example.
• Response-guided opcode enumeration and reboot automation.
• Numbered references to the Quarkslab research and MJA1 SDK wrapper.

Validation passed with git diff --check, citation/reference audits, and forbidden-source checks. mdbook was unavailable locally.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: http://blog.quarkslab.com/black-box-probing-a-security-analysis-of-xiaomis-mja1-secure-chip.html

Content Categories: Based on the analysis, this content was categorized under "Hardware/Physical Access > Firmware Analysis, with generalized subsections under Hardware Hacking > I2C, SPI, and Fault Injection Attacks".

Repository Maintenance:

• MD Files Formatting: 1029 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0