The Fellowship returns with a new write-up on the Eufy ecosystem, this time dissecting the Eufy Home Base 2. The researchers chose this model over the Homebase3 because it was the version deployed in their city and the easiest to buy. The analysis covers firmware version 3.4.2.2h, and readers are urged to read the earlier article on the doorbell first.
The work is split into four parts: firmware extraction, identifying the Wi-Fi credential generation algorithm for the OCEAN_XXXXXX management network, bypassing the UART lockdown by reflashing a backdoored U-Boot image, and adjusting the filesystem so the main binary can run on the recovery image. The author notes that this was their first time working on hardware, having previously focused on downloading firmware from the internet for vulnerability hunting.
Extraction proved difficult. Unlike the doorbell, the Winbond 25Q256JWEQ flash chip on the Homebase was soldered directly to the board with no test pins. Clipping onto it with spring clips and rubber bands produced three different checksums, showing the dumps were unusable, because powering the chip also activated other components. The team therefore desoldered the chip, with a relative of the author doing the work, and read it off-board using a Raspberry Pi's SPI0 interface.
The off-board reads produced consistent checksums and usable data. However, one 64 KB block was erased or unreadable, probably damage caused during desoldering. Binwalk still extracted most of the firmware, allowing analysis to continue despite the loss.
Source: Hacker News · Summarized by HeadlinesBriefing