Hardware & IoT notes

This repo contains my notes on everything I have learnt so far in regards to embedded systems, PCB work and electrical engineering.

I have completed the TCM hardware hacking course by Andrew Bellini (https://academy.tcm-sec.com/p/beginner-s-guide-to-iot-and-hardware-hacking), and the associated practical TP-Link router project. The docs/ folder and TP-Link router project are based on the course work.

I then found a Vtech baby monitor and applied what I learnt.

My study notes on digital electronics are in the repo of the same name https://github.com/jmozzi/digital-electronics.

Disclaimer: Personal learning repo — not vendor research or coordinated disclosure for these devices unless explicitly stated in a given note.

Design goals

• One generic docs/ section as a growing reference space.
• Two concrete projects that contrast on purpose:
  • Router: MPU + Linux + network + filesystem + static analysis targets.
  • Baby monitor: MCU + RF + monolithic flash + factory UART: different trust boundaries and approach.
• Threat models so readers (and future me) see why the steps differ, not only what I ran.
• Next steps: e.g. VTech flash dump still in progress.

Why those two devices?

Lens	TP-Link WR841N	VTech BM2700
Typical “remote” channel	IP (LAN / services)	RF (proximity)
OS	Embedded Linux	Bare-metal / vendor firmware
Live access	UART shell, network tools	Factory test UART, no POSIX shell
Static analysis	Rootfs, .so libraries, web stack	Single flash image / regions
Primary privacy story	Network pivot, creds	A/V stream confidentiality

What I learnt

• Internal and external device inspection, and OSINT (data sheets, FCC check).
• Mapping BOM and discovering hardware interfaces (UART, SPI flash).
• Onboard testing with multimeter to confirm pinouts, ground pins and input voltage.
• UART enumeration for both a full Linux console and a closed test menu: same wires, different semantics.
• Firmware acquisition: vendor images vs in-circuit SPI read.
• binwalk / strings on dumps; Ghidra on MIPS shared objects for decrypt and command-wrapper analysis.
• Writing notes so methodology → docs/ → lab notes stay linked as the repo grows.

Projects

• TP-Link Router (walkthrough with course https://academy.tcm-sec.com/p/beginner-s-guide-to-iot-and-hardware-hacking)

  • UART enumeration and shell access
  • Firmware and root filesystem extraction
  • Binary and library analysis

• VTech Baby Monitor (my own explorations)

  • Hardware interface discovery
  • Firmware extraction from flash
  • Analysis of bare-metal embedded system (no OS)

Tools & environment

• Analysis host: Linux VM (e.g. Kali) with USB passthrough for serial and flash programmers.
• Hardware: multimeter, logic analyser (e.g. PulseView), USB–TTL UART, SOIC clip / CH341A-class SPI programmer.
• Software: screen / serial clients, flashrom, binwalk, strings, Ghidra; optional SDR stack (GNU Radio, URH) for future RF follow-on.
• Notes: Obsidian (wikilinks, embedded images).

Next steps

• VTech: complete SPI flash dump (isolate VCC / finer soldering) → first static pass with strings + Ghidra; optional SDR capture of FHSS traffic.
• TP-Link: finish final challenge
• Vault-wide: add more small MCU or BLE projects using the same methodology + threat model pattern.