garmin-ciq-app-research

I wish someone would take on an open-source project for a sports watch with full features like vo2max estimation, etc. like a cyanogenmod or lineageos but for an older watch model someone has completely decompiled the firmware for the Garmin Forerunner 245 which is very similar to a Fenix 5 imagine if someone took on making open firmware for it https://github.com/anvilsecure/garmin-ciq-app-research/ if taking on a brand name might incur lawsuits there are other watches like the wahoo rival which was completely retired and they got out of the business (it was only $99 too) or there are other ppen hardware options from China

One of my personal favorites. I've used it for parsing SAP's RPC network protocol, reverse-engineering Garmin apps [0], and more recently in a CTF challenge that involved an unknown file format, among others. It's surprisingly quick to pick up once you get the hang of the syntax. The serialization branch for Python [1] (I haven't tried the Java one) has generally done the job for me, though I've had to patch a few edge cases. One feature I've often wished for is access to physical offsets within the file being parsed (e.g. being able to tell that a field foo that you just parsed starts at offset 0x100 from the beginning of the file). As far as I know, you only get relative offsets to the parent structure. 0: https://github.com/anvilsecure/garmin-ciq-app-research/blob/... 1: https://doc.kaitai.io/serialization.html

Your remark seems to match what I've observed during the reverse engineering part of the project. With magic constants like `0xc0debabe` [0] or opcodes like `canhazplz` [1] that you would expect more from a student CS project for instance. [0]: https://github.com/anvilsecure/garmin-ciq-app-research/blob/... [1]: https://github.com/anvilsecure/garmin-ciq-app-research/blob/...

Author here. They did start encrypting the firmware of their latest devices. I noted that the firmware images for Forerunner 55, 945 and 955 were encrypted. Most likely others are as well. In the live demo I did at Hack in the Box a couple of days ago (slides available [0]) I've shown how to exploit one of the vulnerabilities to read the memory of the Forerunner 55, making it possible to dump the firmware unencrypted. The CIQ demo app is also on our GitHub repo [1]. [0]: https://conference.hitb.org/hitbsecconf2023ams/materials/D2T... [1]: https://github.com/anvilsecure/garmin-ciq-app-research/tree/...