Malicous RC Code?
 

An interesting thought just occurred to me. I was thinking about the VCU regional, all those microcontrollers with radio links sitting around, and the (obvious?) issue came to mind. Would it be possible for a program to replicate via radio link, perhaps through some clever buffer overflow? I'm guessing the answer is no, but it's worth looking in to because:

1) It's technically interesting :D
2) You'd want to patch that before someone else has a similar thought :eek:

NOTE: Yes, I know this would be horrible, I don't advocate this kind of thing. Yada, Yada, Yada...

Re: Malicous RC Code?
 

I'm gonna find out now...

Thanks for the treasure hunt. :)

--EDIT--
Or maybe not repicate like a virus. Maybe you could just imitate the OI radio (with a stronger signal, so that you override the real one) and make it appear that the OI is missing, effectively disabling the RC. :)

Re: Malicous RC Code?
 

The FRC is designed to only download code via the prog port. Though i bet that there could be someway a program could be written to beable to download via radio link. Now the biggest issue is the manual control of a download. Prior to any code being able to be downloaded or stored into the memory, you must first manually press the program button, this activates the firmware for a download. So i do not know if it is possible to force a download via the radio link with people not knowing...

Re: Malicous RC Code?
 

Man Texan! You're quick on the draw! I hadn't even fixed my spelling mistakes and, BAM!, you'd replied :-)

I'm on vacation right now, but I REALLY want to look at the code all of the sudden!

Must... find... loophole...

Re: Malicous RC Code?
 

Ah but your missing the key idea here! You don't NEED to download the code! You just need to find a point in the code at which you can overflow a buffer which would allow you to dump arbitrary machine code onto the stack. Thats the idea anyway ;)

Re: Malicous RC Code?
 

Plus, not all computers require you to press the prgm button. If you can find out why, you can overcome that. :)

Re: Malicous RC Code?
 

There was about a 50/50 split between times we had to press the program button, and times where we didn't. Sometimes we'd just fire up the robot and IFI_LOADER, and the program would go, and sometimes we'd have to hit the program button first. I think the bigger problem is that the RC has its radio channel set in hardware with the little switches, so you wouldn't be able to communicate with any other RC's.

Re: Malicous RC Code?
 

Is that REALLY set in hardware? I was under the impression that it was under code control, and that the code simply set it according to those DIP switches. That would be really easy to abuse. :ahh:

Re: Malicous RC Code?
 

But say you had a radio. You could set it to just scan all the channels that the radios could possibly be on. It isn't that many! :)

Re: Malicous RC Code?
 

Yeah, the possibility of being able to screw up the RC's via radio seems good, but it's really not THAT horrible. What would be far more interesting would be if it actually spread from controller to controller.

Re: Malicous RC Code?
 

It really comes down to the "Master Processor." Is that programmable? More importantly, is the code that drives it available?

Re: Malicous RC Code?
 

Hello,

To actually program the robot controller is a little bit complicated task. The processors are PICs and don't lend themselves to easy programming. I would love to dissect one of these controllers to see how the programming circuit is wired.

This idea, to try and overrun a buffer in the RC to execute code, not a bad idea. It is a greater possibility. However think about the sequence for data from the radio. The PIC reads the output from the radio (very small packets) and splits it into even smaller packets. Fitting malicious code in tiny packets will be very difficult, at least.

I don't remember if the PIC is a Harvard or von Neumann (sp?) system. However if it cannot execute stuff from the data parts of the processor, overflows will be very hard indeed.

Good luck with your experimenting.

However, I will stay away from u at competetion... =)

btw, the master processor is not normally programmable. And its code is not readily available. I have asked IFI before, and they have refuse, citing the possibility of ignoring competetion commands.

Re: Malicous RC Code?
 

I figured they wouldn't give that up, and thats probably a good thing. The question remains however, whether the "proprietary radio system," could be reverse engineered. I'm (fairly) certain it's impossible to get the actual code from the microcontroller.

Re: Malicous RC Code?
 

That's only on some systems. In my case, if it doesn't work the first time it's having a bad day: try again. If it still doesn't work, check cables.

Re: Malicous RC Code?
 

That's on the OI. The Controller scans radio channels until it finds one with its Team number (which is set when you tether it). After that, it stays on that channel.
It's as programmable as the user proc. but it's code is on non-volatile ram (Flash, eeprom, etc.). The code that runs it is the firmware update. So if you can decompile it, find a loop hole, and exploit it, you'll be able to make the first FIRST virus! :yikes:
Yes. It's RS-422. You make a spy cable similar to the one found on BeyondLogic.org.
From not For. Decompile the firmware and the libs.
Remember, the controllers themselves are from Microchip, not IFI. They are probably more forthcoming on info than IFI is.

Of course, the packets are continuous, so it delimits them. This nature makes it very dificult to create a buffer overflow.

And above all, if they catch you, you didn't hear it from me.