KidiCFW / DxPWN
DxPWN is a specialized research project developed by Umi,[1] Mikenite,[2] Revilo,[3] and AwsomeCFW.[4] The project is focused on the reverse engineering and exploitation of VTech’s wearable hardware. Following initial work on the KidiZoom DX3 loader, this branch focuses on the KidiZoom DX2 to achieve arbitrary code execution on its ARM-based architecture.
Architecture & Technical Specifications
The DX2 operates on a specialized embedded environment, differing from standard consumer wearables:
- Operating System: uC/OS-II (Real-Time Operating System).
- Processor: ARM-based SoC.
- Storage: ~256MB Internal Flash, partitioned into user-accessible media storage and a hidden system partition.
- Connectivity: Micro-USB utilizing the Mass Storage Class (MSC) and a proprietary protocol for synchronization with VTech's "Learning Lodge" software.
Exploitation Vectors
Filesystem Manipulation
Research into the hidden VT SYSTEM partition. By utilizing low-level disk utilities, researchers aim to bypass standard OS mounting restrictions to access and modify system-level binaries and UI resources.
Firmware Hijacking
The project involves analyzing the .bin firmware blobs transferred during system updates. Key research areas include:
- Checksum Verification: Identifying the algorithm used to sign official firmware to allow for the injection of a custom bootloader.
- Update Handshaking: Monitoring USB traffic (via tools like Wireshark) to spoof the update sequence.
Media Parser Vulnerabilities
The DX2 handles various media formats, including JPEG and AVI. The project investigates potential buffer overflows within these parsers by injecting malformed metadata or oversized headers, which could lead to an execution entry point.
Hardware Debugging
Beyond software exploits, hardware-level access is documented through:
- Test Points: Identifying unpopulated pads on the internal PCB for UART/Serial console access.
- Boot Modes: Documentation of the "Factory Test Mode" (accessed via specific button combinations during the power cycle) to observe hardware diagnostic outputs.
References
awesomecfw/KidiCFW: Multiple exploits for the DX2/DX3 Kidizoom Watch.
This article "KidiCFW / DxPWN" is from Wikipedia. The list of its authors can be seen in its historical and/or the page Edithistory:KidiCFW / DxPWN. Articles copied from Draft Namespace on Wikipedia could be seen on the Draft Namespace of Wikipedia and not main one.
