The Eufy HomeBase 2's Wi-Fi password algorithm cracked after desoldering its flash chip
A story of WiFi secrets, UART lockdowns and a damaged flash memory chip
After damaging the flash memory while desoldering it, we still recovered enough firmware to reverse-engineer the OCEAN_XXXXXX Wi-Fi password generation. The ESSID is OCEAN_ plus the last three MAC bytes, but the password comes from an NVRAM variable set by a stripped MIPS binary. We also bypassed UART lockdown by reflashing a backdoored U-Boot image to get a shell.
Unlike with the doorbell, in this case, the power supplied for the read operation also activated other components on the board that interacted with the memory; therefore, to extract the firmware, we had to desolder the chip and read it off-board.