10 min read
vulnerability research · reverse engineering
Two ways to crash a Tapo C500
Two network protocols, two bugs in the Tapo C500's main process. Ghidra and UART show how each one causes a crash.
NOTES FROM UNDER THE HOOD
Field notes.
Things taken apart. Lessons written down.
14 min read
hardware · reverse engineering
rooting a Tapo C500
A cheap pan-tilt camera, an encrypted filesystem, and a persistent root shell. The whole ride, gotchas and all.