September 2024
Intermediate to advanced
408 pages
7h 29m
English
It’s not uncommon to find that an unlisted chip is actually a commercially available chip with a custom ROM. Such is the RF430TAL152, which is pretty much an RF430FRL152 with a mask ROM that implements a blood glucose monitor in sensors sold under the Freestyle Libre brand.
In this chapter, we’ll discuss a backdoor in the RF430TAL152, first documented in Goodspeed and Apvrille (2019). We’ll begin with the freely available FRL152 variant of the chip, then explore the TAL152 variant, its custom commands, and a backdoor.
Both the TAL152 and the FRL152 have sensor applications in 7kB of masked ROM at 0x4400. Neither of the chips contains flash memory; instead, they use a new memory technology called ...
Read now
Unlock full access