State of RE efforts?

[russkel]

Hello,

Came across this as I have an interest in using M18 batteries for other purposes! Did you guys get any further than what is presented in this repo?

Cheers,

Russ

[lvanasse]

Hi @russkel, sadly this project is not being currently worked on. I am afraid that's all that we currently have. Although, @LazyEngineerToBe may have more information regarding the results.

[russkel]

Thanks @Ludoenso, interested in hearing what the results and outcome was.

[lit-af]

We abandoned this project a little while ago. The internal wiring of the tools was making the reverse engineering a bit tricky.

What I found out is that, when the handshake between the tool and the battery is interrupted, the full voltage is sent on the data lines. So a logic analyzer couldn't be plugged to the data lines since its maximum input voltage is usually around 10V. I've checked the waveform on the oscilloscope but I wasn't able to identify with precision the protocol that's being used. It could be one of the many supported by the chip inside of the battery.

[russkel]

What I found out is that, when the handshake between the tool and the battery is interrupted, the full voltage is sent on the data lines.

That seems a fairly malicious thing for Milwaukee to do.. Thanks for the heads up.

I see the firmware 'dumps' are actually, I would guess it wouldn't have been that easy to simply lift off the firmware from those MCUs.

[lit-af]

You're welcome! I think it's more of a safety feature than an on purpose hacking defence.

Getting the firmware dumps was fairly easy, there's no protection on the pcb to prevent it. The only thing we had to do was to solder pins on the pcb in order to connect the PICkit 3 Debugger.

[russkel]

Getting the firmware dumps was fairly easy, there's no protection on the pcb to prevent it. The only thing we had to do was to solder pins on the pcb in order to connect the PICkit 3 Debugger.

Sorry I didn't complete the sentence: it looks like the firmware dumps are empty. There isn't much/any machine code in there? I tried opening it in Ghidra and there didn't seem to be anything detected.

I think it's more of a safety feature than an on purpose hacking defence.

Oh, out of curiosity how is this a safety feature?

[lit-af]

I tried analyzing the dump too. Without any success. I have no clue if the dump is valid or not. The 6 sequential charger might not have a lot of intelligence in it, hence the short hex dump.

It might be a safety feature inside of the tool. The tool is bypassing the trigger switch and the motor and returning the voltage to the battery, IMO this could prevent an electrical fire.

[russkel]

Thanks @LazyEngineerToBe. If I get any further with this I can let you know, if you're interested.

[lit-af]

If you happen to make any progress, I sure would like to hear about it! 🙂