Drone Hacking Part 1: Dumping Firmware and Bruteforcing ECC

Neodyme researchers dove into the Potensic Atom 2 drone by physically desoldering its NAND chip and extracting firmware through some impressively tedious reverse engineering. They overcame random bit-flip corruption via majority voting across multiple reads, then brute-forced the SoC’s BCH error correction polynomial parameters to correct 247,134 bit errors across 131,072 pages. With the pages repaired, ONEKEY’s ubi_reader pulled two of the three UBI filesystems out of the dump. Part one of the series is pure hardware hacking artistry. Stay tuned for when they inevitably find the drone’s firmware is running something terrifying.