我的显微镜是行车记录仪
My Microscope Is a Dashcam

原始链接: https://xecaz.com/reverse.engineering/tomlovdm9/

许多廉价电子产品都依赖于同一个共享的“Generalplus”参考平台。制造商只是简单地将该基础软件贴牌,却留下了大量“冗余”代码——例如不存在的摄像头的驱动程序或特定车型的功能——原因仅仅是移除它们并不符合成本效益。 尽管这种臃肿的代码效率低下,但更严重的问题在于该平台的安全模型。其固件更新机制缺乏数字签名或校验和等基本验证手段。由于这一缺陷根植于参考架构之中,它影响了全球无数的产品。这种与生俱来的安全性缺失,使得这些设备极易被篡改,或者相反,容易因恶意文件而“变砖”。制造商对此类风险大多漠不关心,且往往拒绝提供合法的固件,导致用户最终只能使用不安全、无人维护且不透明的硬件。

抱歉。
相关文章

原文

What it turned out to be

The answer to the question in the title is that the categories were never really separate. Underneath, this is one Generalplus reference platform. A brand licenses it, changes a splash screen, and ships it into a different market — and the economics never justify removing what the new product doesn't use.

So the microscope carries three and a half seconds of spoken lane-departure warnings it cannot play, a date-stamp overlay picker for footage it will never record, an update mechanism named for a car video recorder, and two sound effects that exist only as names in a table.

And underneath that, the parts that are actually load-bearing somewhere else: drivers for two named accelerometers, a parking mode waiting for an impact that will never come, a second video pipeline for a camera that was never fitted, and the machinery to act as a USB host for one you might plug in. None of it removed, because removing it would have cost someone a day and left the device working exactly as well.

The part that deserves more attention than the joke: that update mechanism accepts any file of the right name from the SD card root and writes it straight to flash, with no signature, no checksum and no version check. That is not a quirk of one brand's build. It is the reference implementation, which makes it the behaviour of every device on this platform.

Which is also the only reason any of this was possible. The same missing safety check that makes the device trivially modifiable is the one that makes it trivially destroyable — and the manufacturer spent four emails insisting there was no firmware to give.

联系我们 contact @ memedata.com