Dead Bytes Tell No Lies: Hands-On NAND Flash Decoding for Access Control Locks - qweary
2026-06-27 11:00 - 12:30 (PST) | Yoga Studio
Somewhere in a pharmacy right now, there's a lock protecting a drug cabinet. The lock stores every user code, privilege level, and active flag in plaintext on a NAND flash chip. No encryption. No MAC. No checksums. No TPM. Just raw bytes in a predictable layout, readable with a $30 programmer and a clip.

In this workshop, you'll learn to decode that layout by hand.

We'll work through real NAND dumps extracted from Alarm Lock Trilogy T3 units; the same locks deployed across healthcare, government, and financial facilities in the US. You'll learn how to identify page boundaries (hint: look for 0xFD), decode 6-digit user codes stored as interleaved ASCII nibbles with a delightful quirk where zero is encoded as “B”, parse permission flags to determine who has master access, and spot the forensic artifacts that indicate flash tampering (like the "Power Up Complete, Data Restored From Flash Memory" audit entry that appears after injection).

Along the way, I'll explain the lazy write model that makes all of this possible: the MSP430 microcontroller only commits volatile RAM to NAND on battery removal or low-voltage interrupt, creating a window where the flash doesn't reflect the lock's current state. We'll also look at what happens when you inject malformed data: some edits will show injected codes in its "Print Users" output (using the vendor's older and less used infrared printer) but silently omit them from "Export Users” in DL-Windows (the vendor audit software used on a computer), creating a stealth window where printed and digital records disagree.

No soldering required. Bring a laptop with a hex editor (HxD, wxHexEditor, or whatever you prefer). I'll provide printed reference sheets with the full NAND page layout and sample binary dumps to work through. If time permits and curiosity demands, I'll have a T48 universal programmer and a lock board on hand for a live read/write demo.

You'll leave knowing how to read embedded flash memory from a class of devices that assumed nobody would bother, and take part in showing that assumption is a security failure.
