Starlink Dishy (Rev2 HW) Teardown Part 1 - UART, Reset, Boot Glitches

Teardown of Starlink Dishy: initial test point mapping including finding UART & reset pins. Experiments with shorting eMMC for pin2pwn style attacks. Note this 'rev2' has a different UART header than previous examples. With input & inspiration thanks to Lennert Wouters - be sure to follow Twitter: LennertWo to catch more analysis (and a blog post at https://www.esat.kuleuven.be/cosic/bl... now too)! Interesting times:

0:00 Intro
0:50 Snapping plastic open
2:10 Blowtorching to heat glue
3:51 PCB visual inspection
8:32 Probing for UART
14:56 Adding UART header
18:00 eMMC Short (pin2pwn)
22:15 Electromagnetic Fault Injection (EMFI)
27:20 Pin Strapping
30:02 Reset Pin / Header
34:00 Reset Pin Testing
36:00 Header Pinouting
38:17 JTAGulator Failing
39:00 Finishing Stuff

Previous teardowns:
-Mike (Nova Scotia!) UART details (see his earlier full teardown too): Starlink Dish TEARDOWN! - Part 2 - Se...
-Ken (first to open the can!): Starlink Teardown: DISHY DESTROYED!
-TheSignalPath (RF stuff detailed): TSP #181 - Starlink Dish Phased Array...

Resources:
- $10 eMMC dumping: Hacking Hardware with a $10 SD Card R...
- Book available soon: https://nostarch.com/hardwarehacking
- eMMC dumping details at: https://www.esat.kuleuven.be/cosic/bl...

Errata:
-POE = power over ethernet (I said 'on' for some reason and didn't notice until now)
-Mid-move so some weirdness of audio/lighting due to setup (like pause at 7:37 when screen froze and I didn't edit out...oops)

• #science_technology
• #starlink
• #hardware_analysis
• #spacex
• #pin2pwn
• #blow_torch_reverse_engineering