Introduction to Reverse Engineering Software

Chapter 3. Gathering Info

Table of Contents

System Wide Process Information
Obtaining Linking information
Obtaining Function Information
Viewing Filesystem Activity
Viewing Open Network Connections
Gathering Network Data

Now the fun begins. The first step to figuring out what is going on in our target program is to gather as much information as we can. Several tools allow us to do this on both platforms. Let's take a look at them.

System Wide Process Information

On Microsoft Windows© as on Linux, several applications will give you varying amounts of information about processes running. However, there is a one stop shop for information on both systems.

/proc

The Linux /proc filesystem contains all sorts of interesting information, from where libraries and other sections of the code are mapped, to which files and sockets are open where. The /proc filesystem contains a directory for each currently running process. So, if you started a process whose pid was 1337, you could enter the directory /proc/1337/ to find out almost anything about this currently running process. You can only view process information for processes which you own.

The files in this directory change with each UNIX OS. The interesting ones in Linux are: cmdline -- lists the command line parameters passed to the process cwd -- a link to the current working directory of the process environ -- a list of the environment variables for the process exe -- the link to the process executable fd -- a list of the file descriptors being used by the process maps -- VERY USEFUL. Lists the memory locations in use by this process. These can be viewed directly with gdb to find out various useful things.

Sysinternals Process Explorer

Sysinternals provides an all-around must-have set of utilities. In this case, Process Explorer is the functional equivalent of /proc. It can show you dll mapping information, right down to which functions are at which addresses, as well as process properties, which includes an environment tab, security attributes, what files and objects are open, what the type of objects those handles are for, etc. It will also allow you to modify processes for which you have access to in ways that are not possible in /proc. You can close handles, change permissions, open debug windows, and change process priority.

Figure 3.1. Process Explorer

Obtaining Linking information

The first step towards understanding how a program works is to analyze what libraries it is linked against. This can help us immediately make predictions as to the type of program we're dealing with and make some insights into its behavior.

ldd

ldd is a basic utility that shows us what libraries a program is linked against, or if its statically linked. It also gives us the addresses that these libraries are mapped into the program's execution space, which can be handy for following function calls in disassembled output (which we will get to shortly).

depends

depends is a utility that comes with the Microsoft© SDK, as well as with MS Visual Studio. It will show you quite a bit about the linking information for a program. Not only will list dll's, but it will list which functions in those DLL's are being imported (used) by the current executable, and how they are imported, and then do this recursively for all dll's linked against the executable.

Figure 3.2. Depends

The layout is a little bit much to process at first. When you click on a DLL, you get the functions from this DLL imported by its parent in the tree (upper right, in green). You also get a list of all the functions that this DLL exports. Those that also present in the imports pane are light blue with a dark blue dot. Those that are called somewhere in the entire linked maze are blue, and those that aren't used at all are grey. Most often all that is used to determine the location of the function is a string and/or an ordinal number, which specifies the numeric index of this function in the export table. Sometimes, the function will be "bound", which means that the linker took a guess at it's location in memory and filled it in. Note that bindings may be rejected as "stale", however, so modifiying this value in the executable won't always give you the results you suspect. We will discuss this more in the code modification and interception sections.

Obtaining Function Information

The next step in reverse engineering is the ability to differentiate functional blocks in programs. Unfortunately, this can prove to be quite difficult if you aren't lucky enough to have debug information enabled. We'll discuss some of those techniques later.

nm

nm lists all of the local and library functions, global variables, and their addresses in the binary. However, it will not work on binaries that have been stripped with strip.

dumpbin.exe

Unfortunately, the closest thing Microsoft Windows© has to nm is dumpbin.exe, which isn't very great. The only thing it can do is essentially what depends already does: that is list functions used by this binary (dumpbin /imports), and list functions provided by this binary (dumpbin /exports). The only way a binary can export a function (and thus the only way the function is visible) is if that function has the __declspec( dllexport ) tag next to it's prototype (FIXME: Verify).

Luckily, depends is so overkill, it often provides us with more than the information we need to get the job done. Furthermore, the cygwin port of objdump also gets the job done a lot of the time. We discuss objdump in Chapter 5.

Viewing Filesystem Activity

lsof

lsof is a program that lists all open files by the processes running on a system. An open file may be a regular file, a directory, a block special file, a character special file, an executing text reference, a library, a stream or a network file (Internet socket, NFS file or UNIX domain socket). It has plenty of options, but in its default mode it gives an extensive listing of the opened files. lsof does not come installed by default with most of the flavors of Linux/UNIX, so you may need to install it by yourself. On some distributions lsof installs in /usr/sbin which by default is not in your path and you will have to add it. An example output would be:

COMMAND     PID  USER   FD   TYPE     DEVICE     SIZE       NODE NAME
bash        101 nasko  cwd    DIR        3,2     4096    1172699 /home/nasko
bash        101 nasko  rtd    DIR        3,2     4096          2 /
bash        101 nasko  txt    REG        3,2   518140    1204132 /bin/bash
bash        101 nasko  mem    REG        3,2   432647     748736 /lib/ld-2.2.3.so
bash        101 nasko  mem    REG        3,2    14831    1399832 /lib/libtermcap.so.2.0.8
bash        101 nasko  mem    REG        3,2    72701     748743 /lib/libdl-2.2.3.so
bash        101 nasko  mem    REG        3,2  4783716     748741 /lib/libc-2.2.3.so
bash        101 nasko  mem    REG        3,2   249120     748742 /lib 
                                                                 /libnss_compat-2.2.3.so
bash        101 nasko  mem    REG        3,2   357644     748746 /lib/libnsl-2.2.3.so
bash        101 nasko    0u   CHR        4,5              260596 /dev/tty5
bash        101 nasko    1u   CHR        4,5              260596 /dev/tty5
bash        101 nasko    2u   CHR        4,5              260596 /dev/tty5
bash        101 nasko  255u   CHR        4,5              260596 /dev/tty5
screen      379 nasko  cwd    DIR        3,2     4096  1172699 /home/nasko
screen      379 nasko  rtd    DIR        3,2     4096          2 /
screen      379 nasko  txt    REG        3,2   250336     358394 /usr/bin/screen-3.9.9
screen      379 nasko  mem    REG        3,2   432647     748736 /lib/ld-2.2.3.so
screen      379 nasko  mem    REG        3,2   357644     748746 /lib/libnsl-2.2.3.so
screen      379 nasko    0r   CHR        1,3              260468 /dev/null
screen      379 nasko    1w   CHR        1,3              260468 /dev/null
screen      379 nasko    2w   CHR        1,3              260468 /dev/null
screen      379 nasko    3r  FIFO        3,2             1334324 /home/nasko/.screen
                                                                 /379.pts-6.slack
startx      729 nasko  cwd    DIR        3,2     4096    1172699 /home/nasko
startx      729 nasko  rtd    DIR        3,2     4096          2 /
startx      729 nasko  txt    REG        3,2   518140    1204132 /bin/bash
ksmserver   794 nasko    3u  unix 0xc8d36580              346900 socket
ksmserver   794 nasko    4r  FIFO        0,6              346902 pipe
ksmserver   794 nasko    5w  FIFO        0,6              346902 pipe
ksmserver   794 nasko    6u  unix 0xd4c83200              346903 socket
ksmserver   794 nasko    7u  unix 0xd4c83540              346905 /tmp/.ICE-unix/794
mozilla-b  5594 nasko  144u  sock        0,0              639105 can't identify protocol
mozilla-b  5594 nasko  146u  unix 0xd18ec3e0              639134 socket
mozilla-b  5594 nasko  147u  sock        0,0              639135 can't identify protocol
mozilla-b  5594 nasko  150u  unix 0xd18ed420              639151 socket

Here is brief explanation of some of the abbreviations lsof uses in its output:

   cwd  current working directory
   mem  memory-mapped file
   pd   parent directory
   rtd  root directory
   txt  program text (code and data)
   CHR  for a character special file
   sock for a socket of unknown domain
   unix for a UNIX domain socket
   DIR  for a directory
   FIFO for a FIFO special file

It is pretty handy tool when it comes to investigating program behavior. lsof reveals plenty of information about what the process is doing under the surface.

	fuser
	A command closely related to lsof is fuser. fuser accepts as a command-line parameter the name of a file or socket. It will return the pid of the process accessing that file or socket.

Sysinternals Filemon

The analog to lsof in the windows world is the Sysinternals Filemon utility. It can show not only open files, but reads, writes, and status requests as well. Furthermore, you can filter by specific process and operation type. A very useful tool. (FIXME: This has a Linux version as well).

Sysinternals Regmon

The registry in Microsoft Windows© is a key part of the system that contains lots of secrets. In order to try and understand how a program works, one definitely should know how the target interacts with the registry. Does it store configuration information, passwords, any useful information, and so on. Regmon from Sysinternals lets you monitor all or selected registry activity in real time. Definitely a must if you plan to work on any target on Microsoft Windows©.

Viewing Open Network Connections

So this is one of the cases where both Linux and Microsoft Windows© have the same exact name for a utility, and it performs the same exact duty. This utility is netstat.

netstat

netstat is handy little tool that is present on all modern operating systems. It is used to display network connections, routing tables, interface statistics, and more.

How can netstat be useful? Let's say we are trying to reverse engineer a program that uses some network communication. A quick look at what netstat displays can give us clues where the program connects and after some investigation maybe why it connects to this host. netstat does not only show TCP/IP connections, but also UNIX domain socket connections which are used in interprocess communication in lots of programs. Here is an example output of it:

Figure 3.3. Netstat output

Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 slack.localnet:58705    egon:ssh                ESTABLISHED
tcp        0      0 slack.localnet:51766    gw.localnet:ssh         ESTABLISHED
tcp        0      0 slack.localnet:51765    gw.localnet:ssh         ESTABLISHED
tcp        0      0 slack.localnet:38980    clortho:ssh             ESTABLISHED
tcp        0      0 slack.localnet:58510    students:ssh            ESTABLISHED
Active UNIX domain sockets (w/o servers)
Proto RefCnt Flags       Type       State         I-Node Path
unix  5      [ ]         DGRAM                    68     /dev/log
unix  3      [ ]         STREAM     CONNECTED     572608 /tmp/.ICE-unix/794
unix  3      [ ]         STREAM     CONNECTED     572607
unix  3      [ ]         STREAM     CONNECTED     572604 /tmp/.X11-unix/X0
unix  3      [ ]         STREAM     CONNECTED     572603
unix  2      [ ]         STREAM                   572488

	NOTE
	The output shown is from Linux system. The Microsoft Windows© output is almost identical.

As you can see there is great deal of info shown by netstat. But what is the meaning of it? The output is divided in two parts - Internet connections and UNIX domain sockets as mentioned above. Here is breifly what the Internet portion of netstat output means. The first column shows the protocol being used (tcp, udp, unix) in the particular connection. Receiving and sending queues for it are displayed in the next two columns, followed by the information identifying the connection - source host and port, destination host and port. The last column of the output shows the state of the connection. Since there are several stages in opening and closing TCP connections, this field was included to show if the connection is ESTABLISHED or in some of the other available states. SYN_SENT, TIME_WAIT, LISTEN are the most often seen ones. To see complete list of the available states look in the man page for netstat. FIXME: Describe these states.

Depending on the options being passed to netstat, it is possible to display more info. In particular interesting for us is the -p option (not available on all UNIX systems). This will show us the program that uses the connection shown, which may help us determine the behaviour of our target. Another use of this options is in tracking down spyware programs that may be installed on your system. Showing all the network connection and looking for unknown entries is invaluable tool in discovering programs that you are unaware of that send information to the network. This can be combined with the -a option to show all connections. By default listening sockets are not displayed in netstat. Using the -a we force all to be shown. -n shows numerical IP addesses instead of hostnames.

        
netstat -p as normal user
(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address         Foreign Address  State  PID/Program name
tcp        0      0 slack.localnet:58705  egon:ssh         ESTABLISHED -
tcp        0      0 slack.localnet:58766  winston:www      ESTABLISHED 5587/mozilla-bin

        
netstat -npa as root user
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address   Foreign Address     State       PID/Program name
tcp        0      0 0.0.0.0:139     0.0.0.0:*           LISTEN      390/smbd
tcp        0      0 0.0.0.0:6000    0.0.0.0:*           LISTEN      737/X
tcp        0      0 0.0.0.0:22      0.0.0.0:*           LISTEN      78/sshd
tcp        0      0 10.0.0.3:58705  128.174.252.100:22  ESTABLISHED 13761/ssh
tcp        0      0 10.0.0.3:51766  10.0.0.1:22         ESTABLISHED 897/ssh
tcp        0      0 10.0.0.3:51765  10.0.0.1:22         ESTABLISHED 896/ssh
tcp        0      0 10.0.0.3:38980  128.174.252.105:22  ESTABLISHED 8272/ssh
tcp        0      0 10.0.0.3:58510  128.174.5.39:22     ESTABLISHED 13716/ssh

So this output shows that mozilla has established a connection with winston for HTTP traffic (since port is www(80)). In the second output we see that the SMB daemon, X server, and ssh daemon listen for incoming connections.

Gathering Network Data

Collecting network data is usually done with a program called sniffer. What the program does is to put your ethernet card into promiscuous mode and gather all the information that it sees. What is a promiscuous mode? Ethernet is a broadcast media. All computers broadcast their messages on the wire and anyone can see those messages. Each network interface card (NIC), as a hardcoded physical address called MAC (Media Access Control) address, which is used in the Ethernet protocol. When sending data over the wire, the OS specifies the destination of the data and only the NIC with the destination MAC address will actually process the data. All other NICs will disregard the data coming on the wire. When in promiscuous mode, the card picks up all the data that it sees and sends it to the OS. In this case you can see all the data that is flowing on your local network segment.

	Disclaimer
	Switched networks eliminate the broadcast to all machines, but sniffing traffic is still possible using certain techniques like ARP poisoning. (FIXME: link with section on ARP poisoning if we have one.)

Several popular sniffing programs exist, which differ in user interface and capabilities, but any one of them will do the job. Here are some good tools that we use on a daily basis:

ethereal - one of the best sniffers out there. It has a graphical interface built with the GTK library. It is not just a sniffer, but also a protocol analyzer. It breaks down the captured data into pieces, showing the meaning of each piece (for example TCP flags like SYN or ACK, or even kerberos or NTLM headers). Furthermore, it has excellent packet filtering mechanisms, and can save captures of network traffic that match a filter for later analysis. It is available for both Microsoft Windows© and Linux and requires (as almost any sniffer) the pcap library. Ethereal is available at www.ethereal.com and you will need libpcap for Linux or WinPcap for Microsoft Windows©.
tcpdump - one of the first sniffing programs. It is a console application that prints info to the screen. The advantage is that it comes by default with most Linux distributions. Microsoft Windows© version is available as well, called WinDump.
ettercap - also a console based sniffer. Uses the ncurses library to provide console GUI. It has built in ARP poisoning capability and supports plugins, which give you the power to modify data on the fly. This makes it very suitable for all kinds of Man-In-The-Middle attacks (MITM), which will we will describe in chapter (FIXME: link). Ettercap isn't that great a sniffer, but nothing prevents you from using its ARP poisoning and plugin features while also running a more powerful sniffer such as ethereal.

Now that you know what a sniffer is and hopefully learned how to use basic functionality of your favorite one, you are all set to gather network data. Let's say you want to know how does a mail client authenticate and fetch messages from the server. Since the protocol in use is POP3, we should instruct ethereal (our sniffer of choice) to capture traffic only destined to port 110 or originating from port 110. In our case since we want to capture both directions of the traffic we can set the filter to be tcp.port == 110. If you have a lot of machines checking mail at the same time on a network with a hub, you might want to restrict the matching only to your machine and the server you are connecting to. Here is an example of captured packet in ethereal:

Figure 3.4. Ethereal capture

Ethereal breaks down the packet for us, showing what each part of the data means. For example, it shows that the Internet Protocol version is 4 or that the header checksum is 0x74bb and is in fact the correct checksum for that packet. It shows in similar manner details for each part of the header and the data at the end of the packet if any.

Using packet captures, one can trace the flow of a protocol to better understand how an application works, or even try to reverse engineer the protocol itself if unknown.

PIC12Fxx full series mcu hack: PIC10F200 PIC10F202 PIC10F204 PIC10F206 PIC10F220 PIC10F222 PIC10F320 PIC10F322 PIC10LF320 PIC10LF322 ...
PIC12Fxx/PIC12LFxx full series mcu hack: PIC12F1501 PIC12F1571 PIC12F1572 PIC12F1822 PIC12F1840 PIC12F508 PIC12F509 PIC12F510 PIC12F519 PIC12F529T39A PIC12F529T48A PIC12F609 PIC12F615 PIC12F617 PIC12F629 PIC12F635 PIC12F675 PIC12F683 PIC12F752 PIC12LF1501 PIC12LF1552 PIC12LF1822 PIC12LF1840 PIC12LF1840T39A PIC12LF1840T48A PIC12HV609 PIC12HV615 PIC12HV752 ...

PIC12Cxx/PIC12CExx full series mcu hack: PIC12C508 PIC12C508A PIC12C509 PIC12C509A PIC12C671 PIC12C672 PIC12CE518 PIC12CE519 PIC12CE625 PIC12CE673 PIC12CE674 PIC12CR509A ...

PIC16Cxx/PIC16CExx/PIC16CRxx full series mcu firmware read: PIC16C432 PIC16C433 PIC16C505 PIC16C52 PIC16C54 PIC16C54A PIC16C54B PIC16C54C PIC16C55 PIC16C554 PIC16C557 PIC16C558 PIC16C55A PIC16C56 PIC16C56A PIC16C57 PIC16C57C PIC16C58A PIC16C58B PIC16C620 PIC16C620A PIC16C621 PIC16C621A PIC16C622 PIC16C622A PIC16C62A PIC16C62B PIC16C63 PIC16C63A PIC16C642 PIC16C64A PIC16C65A PIC16C65B PIC16C66 PIC16C662 PIC16C67 PIC16C71 PIC16C710 PIC16C711 PIC16C712 PIC16C715 PIC16C716 PIC16C717 PIC16C72 PIC16C72A PIC16C73A PIC16C73B PIC16C745 PIC16C74A PIC16C74B PIC16C76 PIC16C765 PIC16C77 PIC16C770 PIC16C771 PIC16C773 PIC16C774 PIC16C781 PIC16C782 PIC16C923 PIC16C924 PIC16C925 PIC16C926 PIC16CE623 PIC16CE624 PIC16CE625 PIC16CR54 PIC16CR54A PIC16CR54C PIC16CR56A PIC16CR57C PIC16CR58B PIC16CR62 PIC16CR620A PIC16CR63 PIC16CR64 PIC16CR65 PIC16CR72 PIC16CR73 PIC16CR74 PIC16CR76 PIC16CR77 PIC16CR83 PIC16CR84 PIC16CR926 ...

PIC16Fxx/PIC16LFxx/PIC16HVxx full series mcu hack: PIC16F1454 PIC16F1455 PIC16F1459 PIC16F1503 PIC16F1507 PIC16F1508 PIC16F1509 PIC16F1512 PIC16F1513 PIC16F1516 PIC16F1517 PIC16F1518 PIC16F1519 PIC16F1526 PIC16F1527 PIC16F1782 PIC16F1783 PIC16F1784 PIC16F1786 PIC16F1787 PIC16F1788 PIC16F1789 PIC16F1823 PIC16F1824 PIC16F1825 PIC16F1826 PIC16F1827 PIC16F1828 PIC16F1829 PIC16F1847 PIC16F1933 PIC16F1934 PIC16F1936 PIC16F1937 PIC16F1938 PIC16F1939 PIC16F1946 PIC16F1947 PIC16F505 PIC16F506 PIC16F526 PIC16F527 PIC16F54 PIC16F57 PIC16F570 PIC16F59 PIC16F610 PIC16F616 PIC16F627 PIC16F627A PIC16F628 PIC16F628A PIC16F630 PIC16F631 PIC16F636 PIC16F639 PIC16F648A PIC16F676 PIC16F677 PIC16F684 PIC16F685 PIC16F687 PIC16F688 PIC16F689 PIC16F690 PIC16F707 PIC16F716 PIC16F72 PIC16F720 PIC16F721 PIC16F722 PIC16F722A PIC16F723 PIC16F723A PIC16F724 PIC16F726 PIC16F727 PIC16F73 PIC16F737 PIC16F74 PIC16F747 PIC16F753 PIC16F76 PIC16F767 PIC16F77 PIC16F777 PIC16F785 PIC16F818 PIC16F819 PIC16F83 PIC16F84 PIC16F84A PIC16F87 PIC16F870 PIC16F871 PIC16F872 PIC16F873 PIC16F873A PIC16F874 PIC16F874A PIC16F876 PIC16F876A PIC16F877 PIC16F877A PIC16F88 PIC16F882 PIC16F883 PIC16F884 PIC16F886 PIC16F887 PIC16F913 PIC16F914 PIC16F916 PIC16F917 PIC16F946 PIC16LF505 PIC16LF506 PIC16LF526 PIC16LF527 PIC16LF54 PIC16LF57 PIC16LF570 PIC16LF59 PIC16LF610 PIC16LF616 PIC16LF627 PIC16LF627A PIC16LF628 PIC16LF628A PIC16LF630 PIC16LF631 PIC16LF636 PIC16LF639 PIC16LF648A PIC16LF676 PIC16LF677 PIC16LF684 PIC16LF685 PIC16LF687 PIC16LF688 PIC16LF689 PIC16LF690 PIC16LF707 PIC16LF716 PIC16LF72 PIC16LF720 PIC16LF721 PIC16LF722 PIC16LF722A PIC16LF723 PIC16LF723A PIC16LF724 PIC16LF726 PIC16LF727 PIC16LF73 PIC16LF737 PIC16LF74 PIC16LF747 PIC16LF753 PIC16LF76 PIC16LF767 PIC16LF77 PIC16LF777 PIC16LF785 PIC16LF818 PIC16LF819 PIC16LF83 PIC16LF84 PIC16LF84A PIC16LF87 PIC16LF870 PIC16LF871 PIC16LF872 PIC16LF873 PIC16LF873A PIC16LF874 PIC16LF874A PIC16LF876 PIC16LF876A PIC16LF877 PIC16LF877A PIC16LF88 PIC16LF882 PIC16LF883 PIC16LF884 PIC16LF886 PIC16LF887 PIC16LF913 PIC16LF914 PIC16LF916 PIC16LF917 PIC16LF946 PIC16HV540 PIC16HV610 PIC16HV616 PIC16HV753 PIC16HV785 PIC16LF1454 PIC16LF1455 PIC16LF1459 PIC16LF1503 PIC16LF1507 PIC16LF1508 PIC16LF1509 PIC16LF1512 PIC16LF1513 PIC16LF1516 PIC16LF1517 PIC16LF1518 PIC16LF1519 PIC16LF1526 PIC16LF1527 PIC16LF1782 PIC16LF1783 PIC16LF1784 PIC16LF1786 PIC16LF1787 PIC16LF1788 PIC16LF1789 PIC16LF1823 PIC16LF1824 PIC16LF1824T39A PIC16LF1825 PIC16LF1826 PIC16LF1827 PIC16LF1828 PIC16LF1829 PIC16LF1847 PIC16LF1902 PIC16LF1903 PIC16LF1904 PIC16LF1906 PIC16LF1907 PIC16LF1933 PIC16LF1934 PIC16LF1936 PIC16LF1937 PIC16LF1938 PIC16LF1939 PIC16LF1946 PIC16LF1947 ...

PIC17Cxx/PIC17LCxx full series mcu hack:PIC17C42 PIC17C42A PIC17C43 PIC17C44 PIC17C752 PIC17C756 PIC17C756A PIC17C762 PIC17C766 PIC17CR42 PIC17CR43 PIC18C242 ...

PIC18Cxx full series mcu hack:PIC18C242 PIC18C252 PIC18C442 PIC18C452 PIC18C601 PIC18C658 PIC18C801 PIC18C858 ...

PIC18Fxx/PIC18FxxJxx/PIC18FxxKxx full series mcu hack: PIC18F1220 PIC18F1230 PIC18F1320 PIC18F1330 PIC18F13K22 PIC18F13K50 PIC18F14K22 PIC18F14K22LIN PIC18F14K50 PIC18F2220 PIC18F2221 PIC18F2320 PIC18F2321 PIC18F2331 PIC18F23K20 PIC18F23K22 PIC18F2410 PIC18F242 PIC18F2420 PIC18F2423 PIC18F2431 PIC18F2439 PIC18F2450 PIC18F2455 PIC18F2458 PIC18F248 PIC18F2480 PIC18F24J10 PIC18F24J11 PIC18F24J50 PIC18F24K20 PIC18F24K22 PIC18F24K50 PIC18F2510 PIC18F2515 PIC18F252 PIC18F2520 PIC18F2523 PIC18F2525 PIC18F2539 PIC18F2550 PIC18F2553 PIC18F258 PIC18F2580 PIC18F2585 PIC18F25J10 PIC18F25J11 PIC18F25J50 PIC18F25K20 PIC18F25K22 PIC18F25K50 PIC18F25K80 PIC18F2610 PIC18F2620 PIC18F2680 PIC18F2682 PIC18F2685 PIC18F26J11 PIC18F26J13 PIC18F26J50 PIC18F26J53 PIC18F26K20 PIC18F26K22 PIC18F26K80 PIC18F27J13 PIC18F27J53 PIC18F4220 PIC18F4221 PIC18F4320 PIC18F4321 PIC18F4331 PIC18F43K20 PIC18F43K22 PIC18F4410 PIC18F442 PIC18F4420 PIC18F4423 PIC18F4431 PIC18F4439 PIC18F4450 PIC18F4455 PIC18F4458 PIC18F448 PIC18F4480 PIC18F44J10 PIC18F44J11 PIC18F44J50 PIC18F44K20 PIC18F44K22 PIC18F4510 PIC18F4515 PIC18F452 PIC18F4520 PIC18F4523 PIC18F4525 PIC18F4539 PIC18F4550 PIC18F4553 PIC18F458 PIC18F4580 PIC18F4585 PIC18F45J10 PIC18F45J11 PIC18F45J50 PIC18F45K20 PIC18F45K22 PIC18F45K50 PIC18F45K80 PIC18F4610 PIC18F4620 PIC18F4680 PIC18F4682 PIC18F4685 PIC18F46J11 PIC18F46J13 PIC18F46J50 PIC18F46J53 PIC18F46K20 PIC18F46K22 PIC18F46K80 PIC18F47J13 PIC18F47J53 PIC18F6310 PIC18F6390 PIC18F6393 PIC18F63J11 PIC18F63J90 PIC18F6410 PIC18F6490 PIC18F6493 PIC18F64J11 PIC18F64J90 PIC18F6520 PIC18F6525 PIC18F6527 PIC18F6585 PIC18F65J10 PIC18F65J11 PIC18F65J15 PIC18F65J50 PIC18F65J90 PIC18F65J94 PIC18F65K22 PIC18F65K80 PIC18F65K90 PIC18F6620 PIC18F6621 PIC18F6622 PIC18F6627 PIC18F6628 PIC18F6680 PIC18F66J10 PIC18F66J11 PIC18F66J15 PIC18F66J16 PIC18F66J50 PIC18F66J55 PIC18F66J60 PIC18F66J65 PIC18F66J90 PIC18F66J93 PIC18F66J94 PIC18F66J99 PIC18F66K22 PIC18F66K80 PIC18F66K90 PIC18F6720 PIC18F6722 PIC18F6723 PIC18F67J10 PIC18F67J11 PIC18F67J50 PIC18F67J60 PIC18F67J90 PIC18F67J93 PIC18F67J94 PIC18F67K22 PIC18F67K90 PIC18F8310 PIC18F8390 PIC18F8393 PIC18F83J11 PIC18F83J90 PIC18F8410 PIC18F8490 PIC18F8493 PIC18F84J11 PIC18F84J90 PIC18F8520 PIC18F8525 PIC18F8527 PIC18F8585 PIC18F85J10 PIC18F85J11 PIC18F85J15 PIC18F85J50 PIC18F85J90 PIC18F85J94 PIC18F85K22 PIC18F85K90 PIC18F8620 PIC18F8621 PIC18F8622 PIC18F8627 PIC18F8628 PIC18F8680 PIC18F86J10 PIC18F86J11 PIC18F86J15 PIC18F86J16 PIC18F86J50 PIC18F86J55 PIC18F86J60 PIC18F86J65 PIC18F86J72 PIC18F86J90 PIC18F86J93 PIC18F86J94 PIC18F86J99 PIC18F86K22 PIC18F86K90 PIC18F8720 PIC18F8722 PIC18F8723 PIC18F87J10 PIC18F87J11 PIC18F87J50 PIC18F87J60 PIC18F87J72 PIC18F87J90 PIC18F87J93 PIC18F87J94 PIC18F87K22 PIC18F87K90 PIC18F95J94 PIC18F96J60 PIC18F96J65 PIC18F96J94 PIC18F96J99 PIC18F97J60 PIC18F97J94 PIC18LF1220 PIC18LF1230 PIC18LF1320 PIC18LF1330 PIC18LF13K22 PIC18LF13K50 PIC18LF14K22 PIC18LF14K22LIN PIC18LF14K50 PIC18LF2220 PIC18LF2221 PIC18LF2320 PIC18LF2321 PIC18LF2331 PIC18LF23K20 PIC18LF23K22 PIC18LF2410 PIC18LF242 PIC18LF2420 PIC18LF2423 PIC18LF2431 PIC18LF2439 PIC18LF2450 PIC18LF2455 PIC18LF2458 PIC18LF248 PIC18LF2480 PIC18LF24J10 PIC18LF24J11 PIC18LF24J50 PIC18LF24K20 PIC18LF24K22 PIC18LF24K50 PIC18LF2510 PIC18LF2515 PIC18LF252 PIC18LF2520 PIC18LF2523 PIC18LF2525 PIC18LF2539 PIC18LF2550 PIC18LF2553 PIC18LF258 PIC18LF2580 PIC18LF2585 PIC18LF25J10 PIC18LF25J11 PIC18LF25J50 PIC18LF25K20 PIC18LF25K22 PIC18LF25K50 PIC18LF25K80 PIC18LF2610 PIC18LF2620 PIC18LF2680 PIC18LF2682 PIC18LF2685 PIC18LF26J11 PIC18LF26J13 PIC18LF26J50 PIC18LF26J53 PIC18LF26K20 PIC18LF26K22 PIC18LF26K80 PIC18LF27J13 PIC18LF27J53 PIC18LF4220 PIC18LF4221 PIC18LF4320 PIC18LF4321 PIC18LF4331 PIC18LF43K20 PIC18LF43K22 PIC18LF4410 PIC18LF442 PIC18LF4420 PIC18LF4423 PIC18LF4431 PIC18LF4439 PIC18LF4450 PIC18LF4455 PIC18LF4458 PIC18LF448 PIC18LF4480 PIC18LF44J10 PIC18LF44J11 PIC18LF44J50 PIC18LF44K20 PIC18LF44K22 PIC18LF4510 PIC18LF4515 PIC18LF452 PIC18LF4520 PIC18LF4523 PIC18LF4525 PIC18LF4539 PIC18LF4550 PIC18LF4553 PIC18LF458 PIC18LF4580 PIC18LF4585 PIC18LF45J10 PIC18LF45J11 PIC18LF45J50 PIC18LF45K20 PIC18LF45K22 PIC18LF45K50 PIC18LF45K80 PIC18LF4610 PIC18LF4620 PIC18LF4680 PIC18LF4682 PIC18LF4685 PIC18LF46J11 PIC18LF46J13 PIC18LF46J50 PIC18LF46J53 PIC18LF46K20 PIC18LF46K22 PIC18LF46K80 PIC18LF47J13 PIC18LF47J53 PIC18LF6310 PIC18LF6390 PIC18LF6393 PIC18LF63J11 PIC18LF63J90 PIC18LF6410 PIC18LF6490 PIC18LF6493 PIC18LF64J11 PIC18LF64J90 PIC18LF6520 PIC18LF6525 PIC18LF6527 PIC18LF6585 PIC18LF65J10 PIC18LF65J11 PIC18LF65J15 PIC18LF65J50 PIC18LF65J90 PIC18LF65J94 PIC18LF65K22 PIC18LF65K80 PIC18LF65K90 PIC18LF6620 PIC18LF6621 PIC18LF6622 PIC18LF6627 PIC18LF6628 PIC18LF6680 PIC18LF66J10 PIC18LF66J11 PIC18LF66J15 PIC18LF66J16 PIC18LF66J50 PIC18LF66J55 PIC18LF66J60 PIC18LF66J65 PIC18LF66J90 PIC18LF66J93 PIC18LF66J94 PIC18LF66J99 PIC18LF66K22 PIC18LF66K80 PIC18LF66K90 PIC18LF6720 PIC18LF6722 PIC18LF6723 PIC18LF67J10 PIC18LF67J11 PIC18LF67J50 PIC18LF67J60 PIC18LF67J90 PIC18LF67J93 PIC18LF67J94 PIC18LF67K22 PIC18LF67K90 PIC18LF8310 PIC18LF8390 PIC18LF8393 PIC18LF83J11 PIC18LF83J90 PIC18LF8410 PIC18LF8490 PIC18LF8493 PIC18LF84J11 PIC18LF84J90 PIC18LF8520 PIC18LF8525 PIC18LF8527 PIC18LF8585 PIC18LF85J10 PIC18LF85J11 PIC18LF85J15 PIC18LF85J50 PIC18LF85J90 PIC18LF85J94 PIC18LF85K22 PIC18LF85K90 PIC18LF8620 PIC18LF8621 PIC18LF8622 PIC18LF8627 PIC18LF8628 PIC18LF8680 PIC18LF86J10 PIC18LF86J11 PIC18LF86J15 PIC18LF86J16 PIC18LF86J50 PIC18LF86J55 PIC18LF86J60 PIC18LF86J65 PIC18LF86J72 PIC18LF86J90 PIC18LF86J93 PIC18LF86J94 PIC18LF86J99 PIC18LF86K22 PIC18LF86K90 PIC18LF8720 PIC18LF8722 PIC18LF8723 PIC18LF87J10 PIC18LF87J11 PIC18LF87J50 PIC18LF87J60 PIC18LF87J72 PIC18LF87J90 PIC18LF87J93 PIC18LF87J94 PIC18LF87K22 PIC18LF87K90 PIC18LF95J94 PIC18LF96J60 PIC18LF96J65 PIC18LF96J94 PIC18LF96J99 PIC18LF97J60 PIC18LF97J94 ...

PIC24Fxx full series mcu firmware hack: PIC24EP128GP202 PIC24EP128GP204 PIC24EP128GP206 PIC24EP128MC202 PIC24EP128MC204 PIC24EP128MC206 PIC24EP256GP202 PIC24EP256GP204 PIC24EP256GP206 PIC24EP256GU810 PIC24EP256GU814 PIC24EP256MC202 PIC24EP256MC204 PIC24EP256MC206 PIC24EP32GP202 PIC24EP32GP203 PIC24EP32GP204 PIC24EP32MC202 PIC24EP32MC203 PIC24EP32MC204 PIC24EP512GP202 PIC24EP512GP204 PIC24EP512GP206 PIC24EP512GP806 PIC24EP512GU810 PIC24EP512GU814 PIC24EP512MC202 PIC24EP512MC204 PIC24EP512MC206 PIC24EP64GP202 PIC24EP64GP203 PIC24EP64GP204 PIC24EP64GP206 PIC24EP64MC202 PIC24EP64MC203 PIC24EP64MC204 PIC24EP64MC206 PIC24F04KA200 PIC24F04KA201 PIC24F04KL100 PIC24F04KL101 PIC24F08KA101 PIC24F08KA102 PIC24F08KL200 PIC24F08KL201 PIC24F08KL301 PIC24F08KL302 PIC24F08KL401 PIC24F08KL402 PIC24F08KM101 PIC24F08KM102 PIC24F08KM202 PIC24F08KM204 PIC24F16KA101 PIC24F16KA102 PIC24F16KA301 PIC24F16KA302 PIC24F16KA304 PIC24F16KL401 PIC24F16KL402 PIC24F16KM102 PIC24F16KM104 PIC24F16KM202 PIC24F16KM204 PIC24F32KA301 PIC24F32KA302 PIC24F32KA304 PIC24FJ128DA106 PIC24FJ128DA110 PIC24FJ128DA206 PIC24FJ128DA210 PIC24FJ128GA006 PIC24FJ128GA008 PIC24FJ128GA010 PIC24FJ128GA106 PIC24FJ128GA108 PIC24FJ128GA110 PIC24FJ128GA202 PIC24FJ128GA204 PIC24FJ128GA306 PIC24FJ128GA308 PIC24FJ128GA310 PIC24FJ128GB106 PIC24FJ128GB108 PIC24FJ128GB110 PIC24FJ128GB202 PIC24FJ128GB204 PIC24FJ128GB206 PIC24FJ128GB210 PIC24FJ128GC006 PIC24FJ128GC010 PIC24FJ16GA002 PIC24FJ16GA004 PIC24FJ16MC101 PIC24FJ16MC102 PIC24FJ192GA106 PIC24FJ192GA108 PIC24FJ192GA110 PIC24FJ192GB106 PIC24FJ192GB108 PIC24FJ192GB110 PIC24FJ256DA106 PIC24FJ256DA110 PIC24FJ256DA206 PIC24FJ256DA210 PIC24FJ256GA106 PIC24FJ256GA108 PIC24FJ256GA110 PIC24FJ256GB106 PIC24FJ256GB108 PIC24FJ256GB110 PIC24FJ256GB206 PIC24FJ256GB210 PIC24FJ32GA002 PIC24FJ32GA004 PIC24FJ32GA102 PIC24FJ32GA104 PIC24FJ32GB002 PIC24FJ32GB004 PIC24FJ32MC101 PIC24FJ32MC102 PIC24FJ32MC104 PIC24FJ48GA002 PIC24FJ48GA004 PIC24FJ64GA002 PIC24FJ64GA004 PIC24FJ64GA006 PIC24FJ64GA008 PIC24FJ64GA010 PIC24FJ64GA102 PIC24FJ64GA104 PIC24FJ64GA106 PIC24FJ64GA108 PIC24FJ64GA110 PIC24FJ64GA202 PIC24FJ64GA204 PIC24FJ64GA306 PIC24FJ64GA308 PIC24FJ64GA310 PIC24FJ64GB002 PIC24FJ64GB004 PIC24FJ64GB106 PIC24FJ64GB108 PIC24FJ64GB110 PIC24FJ64GB202 PIC24FJ64GB204 PIC24FJ64GC006 PIC24FJ64GC010 PIC24FJ96GA006 PIC24FJ96GA008 PIC24FJ96GA010 PIC24FV08KM101 PIC24FV08KM102 PIC24FV08KM202 PIC24FV08KM204 PIC24FV16KA301 PIC24FV16KA302 PIC24FV16KA304 PIC24FV16KM102 PIC24FV16KM104 PIC24FV16KM202 PIC24FV16KM204 PIC24FV32KA301 PIC24FV32KA302 PIC24FV32KA304 PIC24HJ128GP202 PIC24HJ128GP204 PIC24HJ128GP206 PIC24HJ128GP206A PIC24HJ128GP210 PIC24HJ128GP210A PIC24HJ128GP306 PIC24HJ128GP306A PIC24HJ128GP310 PIC24HJ128GP310A PIC24HJ128GP502 PIC24HJ128GP504 PIC24HJ128GP506 PIC24HJ128GP506A PIC24HJ128GP510 PIC24HJ128GP510A PIC24HJ12GP201 PIC24HJ12GP202 PIC24HJ16GP304 PIC24HJ256GP206 PIC24HJ256GP206A PIC24HJ256GP210 PIC24HJ256GP210A PIC24HJ256GP610 PIC24HJ256GP610A PIC24HJ32GP202 PIC24HJ32GP204 PIC24HJ32GP302 PIC24HJ32GP304 PIC24HJ64GP202 PIC24HJ64GP204 PIC24HJ64GP206 PIC24HJ64GP206A PIC24HJ64GP210 PIC24HJ64GP210A PIC24HJ64GP502 PIC24HJ64GP504 PIC24HJ64GP506 PIC24HJ64GP506A PIC24HJ64GP510 PIC24HJ64GP510A ...

dsPIC33xx full series mcu read out: dsPIC33EP128GM304 dsPIC33EP128GM306 dsPIC33EP128GM310 dsPIC33EP128GM604 dsPIC33EP128GM706 dsPIC33EP128GM710 dsPIC33EP128GP502 dsPIC33EP128GP504 dsPIC33EP128GP506 dsPIC33EP128MC202 dsPIC33EP128MC204 dsPIC33EP128MC206 dsPIC33EP128MC502 dsPIC33EP128MC504 dsPIC33EP128MC506 dsPIC33EP256GM304 dsPIC33EP256GM306 dsPIC33EP256GM310 dsPIC33EP256GM604 dsPIC33EP256GM706 dsPIC33EP256GM710 dsPIC33EP256GP502 dsPIC33EP256GP504 dsPIC33EP256GP506 dsPIC33EP256MC202 dsPIC33EP256MC204 dsPIC33EP256MC206 dsPIC33EP256MC502 dsPIC33EP256MC504 dsPIC33EP256MC506 dsPIC33EP256MU806 dsPIC33EP256MU810 dsPIC33EP256MU814 dsPIC33EP32GP502 dsPIC33EP32GP503 dsPIC33EP32GP504 dsPIC33EP32MC202 dsPIC33EP32MC203 dsPIC33EP32MC204 dsPIC33EP32MC502 dsPIC33EP32MC503 dsPIC33EP32MC504 dsPIC33EP512GM304 dsPIC33EP512GM306 dsPIC33EP512GM310 dsPIC33EP512GM604 dsPIC33EP512GM706 dsPIC33EP512GM710 dsPIC33EP512GP502 dsPIC33EP512GP504 dsPIC33EP512GP506 dsPIC33EP512GP806 dsPIC33EP512MC202 dsPIC33EP512MC204 dsPIC33EP512MC206 dsPIC33EP512MC502 dsPIC33EP512MC504 dsPIC33EP512MC506 dsPIC33EP512MC806 dsPIC33EP512MU810 dsPIC33EP512MU814 dsPIC33EP64GP502 dsPIC33EP64GP503 dsPIC33EP64GP504 dsPIC33EP64GP506 dsPIC33EP64MC202 dsPIC33EP64MC203 dsPIC33EP64MC204 dsPIC33EP64MC206 dsPIC33EP64MC502 dsPIC33EP64MC503 dsPIC33EP64MC504 dsPIC33EP64MC506 dsPIC33FJ06GS001 dsPIC33FJ06GS101 dsPIC33FJ06GS101A dsPIC33FJ06GS102 dsPIC33FJ06GS102A dsPIC33FJ06GS202 dsPIC33FJ06GS202A dsPIC33FJ09GS302 dsPIC33FJ128GP202 dsPIC33FJ128GP204 dsPIC33FJ128GP206 dsPIC33FJ128GP206A dsPIC33FJ128GP306 dsPIC33FJ128GP306A dsPIC33FJ128GP310 dsPIC33FJ128GP310A dsPIC33FJ128GP706 dsPIC33FJ128GP706A dsPIC33FJ128GP708 dsPIC33FJ128GP708A dsPIC33FJ128GP710 dsPIC33FJ128GP710A dsPIC33FJ128GP802 dsPIC33FJ128GP804 dsPIC33FJ128MC202 dsPIC33FJ128MC204 dsPIC33FJ128MC506 dsPIC33FJ128MC506A dsPIC33FJ128MC510 dsPIC33FJ128MC510A dsPIC33FJ128MC706 dsPIC33FJ128MC706A dsPIC33FJ128MC708 dsPIC33FJ128MC708A dsPIC33FJ128MC710 dsPIC33FJ128MC710A dsPIC33FJ128MC802 dsPIC33FJ128MC804 dsPIC33FJ12GP201 dsPIC33FJ12GP202 dsPIC33FJ12MC201 dsPIC33FJ12MC202 dsPIC33FJ16GP101 dsPIC33FJ16GP102 dsPIC33FJ16GP304 dsPIC33FJ16GS402 dsPIC33FJ16GS404 dsPIC33FJ16GS502 dsPIC33FJ16GS504 dsPIC33FJ16MC101 dsPIC33FJ16MC102 dsPIC33FJ16MC304 dsPIC33FJ256GP506 dsPIC33FJ256GP506A dsPIC33FJ256GP510 dsPIC33FJ256GP510A dsPIC33FJ256GP710 dsPIC33FJ256GP710A dsPIC33FJ256MC510 dsPIC33FJ256MC510A dsPIC33FJ256MC710 dsPIC33FJ256MC710A dsPIC33FJ32GP101 dsPIC33FJ32GP102 dsPIC33FJ32GP104 dsPIC33FJ32GP202 dsPIC33FJ32GP204 dsPIC33FJ32GP302 dsPIC33FJ32GP304 dsPIC33FJ32GS406 dsPIC33FJ32GS606 dsPIC33FJ32GS608 dsPIC33FJ32GS610 dsPIC33FJ32MC101 dsPIC33FJ32MC102 dsPIC33FJ32MC104 dsPIC33FJ32MC202 dsPIC33FJ32MC204 dsPIC33FJ32MC302 dsPIC33FJ32MC304 dsPIC33FJ64GP202 dsPIC33FJ64GP204 dsPIC33FJ64GP206 dsPIC33FJ64GP206A dsPIC33FJ64GP306 dsPIC33FJ64GP306A dsPIC33FJ64GP310 dsPIC33FJ64GP310A dsPIC33FJ64GP706 dsPIC33FJ64GP706A dsPIC33FJ64GP708 dsPIC33FJ64GP708A dsPIC33FJ64GP710 dsPIC33FJ64GP710A dsPIC33FJ64GP802 dsPIC33FJ64GP804 dsPIC33FJ64GS406 dsPIC33FJ64GS606 dsPIC33FJ64GS608 dsPIC33FJ64GS610 dsPIC33FJ64MC202 dsPIC33FJ64MC204 dsPIC33FJ64MC506 dsPIC33FJ64MC506A dsPIC33FJ64MC508 dsPIC33FJ64MC508A dsPIC33FJ64MC510 dsPIC33FJ64MC510A dsPIC33FJ64MC706 dsPIC33FJ64MC706A dsPIC33FJ64MC710 dsPIC33FJ64MC710A dsPIC33FJ64MC802 dsPIC33FJ64MC804 ...

PIC32xx full series mcu read out: PIC32MX110F016B PIC32MX110F016C PIC32MX110F016D PIC32MX120F032B PIC32MX120F032C PIC32MX120F032D PIC32MX130F064B PIC32MX130F064C PIC32MX130F064D PIC32MX150F128B PIC32MX150F128C PIC32MX150F128D PIC32MX210F016B PIC32MX210F016C PIC32MX210F016D PIC32MX220F032B PIC32MX220F032C PIC32MX220F032D PIC32MX230F064B PIC32MX230F064C PIC32MX230F064D PIC32MX250F128B PIC32MX250F128C PIC32MX250F128D PIC32MX320F032H PIC32MX320F064H PIC32MX320F128H PIC32MX320F128L PIC32MX330F064H PIC32MX330F064L PIC32MX340F128H PIC32MX340F128L PIC32MX340F256H PIC32MX340F512H PIC32MX350F128H PIC32MX350F128L PIC32MX350F256H PIC32MX350F256L PIC32MX360F256L PIC32MX360F512L PIC32MX420F032H PIC32MX430F064H PIC32MX430F064L PIC32MX440F128H PIC32MX440F128L PIC32MX440F256H PIC32MX440F512H PIC32MX450F128H PIC32MX450F128L PIC32MX450F256H PIC32MX450F256L PIC32MX460F256L PIC32MX460F512L PIC32MX534F064H PIC32MX534F064L PIC32MX564F064H PIC32MX564F064L PIC32MX564F128H PIC32MX564F128L PIC32MX575F256H PIC32MX575F256L PIC32MX575F512H PIC32MX575F512L PIC32MX664F064H PIC32MX664F064L PIC32MX664F128H PIC32MX664F128L PIC32MX675F256H PIC32MX675F256L PIC32MX675F512H PIC32MX675F512L PIC32MX695F512H PIC32MX695F512L PIC32MX764F128H PIC32MX764F128L PIC32MX775F256H PIC32MX775F256L PIC32MX775F512H PIC32MX775F512L PIC32MX795F512H PIC32MX795F512L

dsPIC30Fxx full series mcu firmware hack: dsPIC30F1010 dsPIC30F2010 dsPIC30F2011 dsPIC30F2012 dsPIC30F2020 dsPIC30F2023 dsPIC30F3010 dsPIC30F3011 dsPIC30F3012 dsPIC30F3013 dsPIC30F3014 dsPIC30F4011 dsPIC30F4012 dsPIC30F4013 dsPIC30F5011 dsPIC30F5013 dsPIC30F5015 dsPIC30F5016 dsPIC30F6010 dsPIC30F6010A dsPIC30F6011 dsPIC30F6011A dsPIC30F6012 dsPIC30F6012A dsPIC30F6013 dsPIC30F6013A dsPIC30F6014 dsPIC30F6014A dsPIC30F6015 ...

HCSxx series mcu firmware hack: HCS300 HCS301 HCS360 HCS361 HCS362 HCS412 HCS500 HCS512 HCS515 ...