A 2014 Renault Latitude will not let you adjust the dashboard clock without an original Renault SD card loaded with valid map data. No card, no time setting. Rasmus Moorats refused to pay for one and reverse-engineered the system instead.
The navigation unit runs embedded Linux and accepts scripts from the SD card, but inside a strict sandbox. Moorats found the exit by abusing the scripting language's built-in logging functions to overwrite the OS-level `core_pattern` string, which executes whenever a process crashes. He then intentionally crashed a binary to trigger arbitrary command execution and rewrote the config file holding the time data.
The clock fix is a footnote. The real value here is a step-by-step case study in breaking out of a locked-down embedded Linux environment, covering sandbox probing, crash-based code execution, and config manipulation on hardware you cannot easily reflash. Read the full write-up on Moorats' blog if you work with constrained embedded systems, because several of these techniques transfer directly.
[READ ORIGINAL →]