Thread by @atc1441

Here is the full Philips Sonicare Head NFC Password Calculation 🥳

How I got there you can find in this Thread.
1/N

Since lately the RF sniffing of the NFC Password was blogged by Cyrill Künzi kuenzi.dev/toothbrush/ I could not stop thinking on how to crack it.

So this afternoon I bought the cheapest available Toothbrush with the NFC feature (40€) and opened it up.

Quite simple to open!

Inside of this version we can find an
NXP NFC Reader MFRC630
and an MindMotion MM32F001 Cortex M0 SoC
16Kb Flash and 2Kb RAM

Plus nicely labeled Debug Pins...

Ok how much on the bet that it will be locked... but lets see...

Very unusual, after hitting connect I was greeted by a happily connected SWD Flasher which was able to read the full flash without problems 🥳
wonder who slept there at Philips...

After an exiting reverse engineering session in IDA everything came together and the NFC Password calculation was found.

And as shown already its a very simple CRC Calculation over the NFC Tag UID and the Manufacturing String that is in NFC Tag and also printed on the Brush Head

That's all 🙂

Finally that thought is satisfied!
You can find this story on YouTube as well:


And of course the example code here:
gist.github.com/atc1441/41af75…