Hacking the eVic

[EricSFla]

It looks encrypted to me as well. It doesn't seem that the voltage or wattage limitations are limited by firmware, but by hardware, so I wouldn't expect any firmware update to lift any limits.

Agreed, but in 1.0 the wattage limit is 15 watts, now it is 11 watts. Did the hardware change? I don't know. I also don't like that it scales back based on the atomizer. I have cheaper hardware that lets me to set my voltage and it delivers it, why not the evic? Or is it a pretty girl on the outside and a hollow soul in the outside? (meaning cheaper than cheap (VAMO) hardware).

Basically, I use a rebuildable genesis atomizer and they do require higher wattage, but with my evic, I barely get a whiff of vapor.

 

[EricSFla]

If anyone were to decrypt the firmware into a reversible output, I doubt one would remove the puff counter. However if I can decrypt it, I'm planning to look at bugs like the freezing, the fact that it says "Not Atomizer Find" rather than "found," etc. If I make any progress I would definitely release it as a custom firmware that one could install onto his/her eVic.

If for anything else, i just want to see what is in there. I need something to occupy my time, haha. (Don't get laid by choice before anyone says anything, haha).

 

[Judge Dredd]

Does anyone have IDA Disassembler, it has a way to reverse engineer eprom software.

Yeah I have IDA Pro.

 

[Judge Dredd]

I can't seem to get past the encryption. #Frustrated

 

[Judge Dredd]

I am working on deobfuscating it now! I will let you know my progress.

 

[Rock0900]

Gl on this. Will love to see if this is doable.
If so and I get some time off, will be happy to jump in and do something about the interface.

 

[Judge Dredd]

Gl on this. Will love to see if this is doable.
If so and I get some time off, will be happy to jump in and do something about the interface.

Thank you! I am having a hard time finding what type of obfuscation was used. If I can't get past the obfuscation there's no chance of modifying or creating a custom firmware.

 

[evilkorn]

This is the first thing I thought of when they said there would be firmware updates. As an Android modder it made me a smile that they put out a mod that could be "hackable".

 

[Judge Dredd]

This is the first thing I thought of when they said there would be firmware updates. As an Android modder it made me a smile that they put out a mod that could be "hackable".

Well, we hope it is.

 

[EricSFla]

This is the first thing I thought of when they said there would be firmware updates. As an Android modder it made me a smile that they put out a mod that could be "hackable".

Its a matter of time, in this day and age, any popular product that can be hacked, will be hacked. How long it will take, I have no idea.

 

[Aphex13]

I know it's almost completely useless information, but the Ovale version of the eVic has it's own MVR software and firmware. I own the Joyetech version. I was able to upgrade the firmware using either MVR software version, and either firmware version. The only change it made was the boot logo. At least we know the logo is in the firmware file, and not hard coded to the device. I know it's just eye candy, but I think it would be nice to make my own logo somewhere down the road.

It looks like after MVR 1.2's release, the firmware will be packed with the MVR software in a single exe. Hopefully this won't complicate things too much.

 

[T41CK]

I dont have an evic but I do have a hacked iphone. When this gets figured out I might have to get one.

 

[EricSFla]

I know it's almost completely useless information, but the Ovale version of the eVic has it's own MVR software and firmware. I own the Joyetech version. I was able to upgrade the firmware using either MVR software version, and either firmware version. The only change it made was the boot logo. At least we know the logo is in the firmware file, and not hard coded to the device. I know it's just eye candy, but I think it would be nice to make my own logo somewhere down the road.

It looks like after MVR 1.2's release, the firmware will be packed with the MVR software in a single exe. Hopefully this won't complicate things too much.

One of the owners of Ovale is Joyetech, so I can see why they have a branded firmware and pc software. The logo seems to be in the software since I am able to replace the Joyetech logo with the Ovale logo only by changing the firmware not the MVR software. Being that it is a low res image, it would fit on 64k firmware without a problem and still have plenty of room for the code.

I am not sure if knowing their is an image would make hacking the firmware easier. I am still trying everything I can to decrypt and disassemble the firmware which would be the easiest way to hack it. But if the decryption is strong, then it will be almost impossible to decrypt.

Other possibility is trying to hack it through the USB connection, trying to figure that out as well, if possible.

 

[EricSFla]

Here is the public documents on Ovale, did not say very much:

www.sunbiz.org - Department of State

 

[Judge Dredd]

One of the owners of Ovale is Joyetech, so I can see why they have a branded firmware and pc software. The logo seems to be in the software since I am able to replace the Joyetech logo with the Ovale logo only by changing the firmware not the MVR software. Being that it is a low res image, it would fit on 64k firmware without a problem and still have plenty of room for the code.

I am not sure if knowing their is an image would make hacking the firmware easier. I am still trying everything I can to decrypt and disassemble the firmware which would be the easiest way to hack it. But if the decryption is strong, then it will be almost impossible to decrypt.

Other possibility is trying to hack it through the USB connection, trying to figure that out as well, if possible.

Sniffing the USB connection may be our only option. I have had zero luck deobfuscating th file. Most deobfuscators and disassemblers won't even open it because it's a BIN file.

 

[Rock0900]

I doubt the evic itself does decrypt it's own firmware file.
Did you check this thread? http://www.e-cigarette-forum.com/fo...sassembling-joyetech-evic-firmware-image.html
like minded people with some progress it seems.

 

[bitterskittles]

This guy claims to have flashed the firmware v2.0 using MVR v1.0
Joyetech eVic Firmware 2.0 Quick Look

Also, MVR can be tricked to decrypt the firmware file, which can be dumped from MVR process memory ofc, even without an eVic connected to the system

 

[bitterskittles]

That reviewed 'Burssaro' ( or whatever his name is) on YouTube hooked it up to ossiliscope, noticed pulsing, tells me that it is pulsing to look for data changes- but, thats just my opinion.

This reviewer thinks that the pediodic pulse could be something used to detect the presence of an atomizer attached to the unit.
JoyeTech eVic Full Review v1.1 - YouTube (starts at 26:15)

 

[TimmyB5286]

This guy claims to have flashed the firmware v2.0 using MVR v1.0
Joyetech eVic Firmware 2.0 Quick Look

Also, MVR can be tricked to decrypt the firmware file, which can be dumped from MVR process memory ofc, even without an eVic connected to the system

I want his little birdy to drop it off to me as well...

 

[Sad Society]

I'm interested in this thread.

One thing I can say is that the Evic itself seems 'Buggy'

Last week I hooked up my Evic to the comp. and the MVR. The MVR said that on Dec. 28th 2012 there were 15 puffs taken on that day. But I know that this is impossible because during that time the Evic was in shipment from China and I recieved the kit on Jan 7th.

But it could just be an error on my end...meaning that maybe the Evic was set to that day when I recieved it and I was trying it out before I went through and set the proper date and time. I'm pretty sure this is the case.

Another thing is, I don't hook it up to the computer that often. Maybe once every two weeks. The last couple of times I hooked it up my comp. it doesn't recognize it. I says 'hardware not found'. So I go and reinstall the MVR and then it works. And it still has all my previous saved data from before. So it could just be my comp. and not the Evic. Anyways this is why I say it 'seems' buggy.